CVE-2026-22733

Authentication Bypass under Actuator CloudFoundry endpoints

State: Published
Severity: 8.2 High
Published: Mar 19, 2026
Updated: Mar 20, 2026
Reserved: Jan 9, 2026

Description

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N	vmware

Weaknesses

CWE-288 Authentication bypass using an alternate path or channel

Affected Products

Product	Versions
Spring SecuritySpring	4.0.0 through 4.0.3Affected 3.5.0 through 3.5.11Affected 3.4.0 through 3.4.14Affected 3.3.0 through 3.3.17Affected 2.7.0 through 2.7.31Affected

References

https://spring.io/security/cve-2026-22733

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.