CVE-2026-22731

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

Score

CVSS 3.1 8.2 High

Status

Analyzed - security@vmware.com

Published

2026-03-19

Last modified

2026-03-20

Weaknesses

CWE-288, CWE-306

Affected products

• Spring Boot (Spring)
• Spring Boot (Vmware)

References

• https://spring.io/security/cve-2026-22731