Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://spring.io/security/cve-2026-22733 |
|
History
Thu, 19 Mar 2026 23:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31. | |
| Title | Authentication Bypass under Actuator CloudFoundry endpoints | |
| Weaknesses | CWE-288 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: vmware
Published:
Updated: 2026-03-19T23:29:10.098Z
Reserved: 2026-01-09T06:54:41.498Z
Link: CVE-2026-22733
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-20T00:16:15.513
Modified: 2026-03-20T00:16:15.513
Link: CVE-2026-22733
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses