CVE-2026-22731

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22731
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22731.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22731
Aliases
Downstream
Related
Published
2026-03-19T22:36:15.112Z
Modified
2026-07-15T01:48:55.951797982Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Authentication Bypass under Actuator Health groups paths
Details

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.0"
                },
                {
                    "fixed": "4.0.3"
                },
                {
                    "introduced": "3.5"
                },
                {
                    "fixed": "3.5.11"
                },
                {
                    "introduced": "3.4"
                },
                {
                    "fixed": "3.4.15"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "4.0"
                },
                {
                    "fixed": "4.0.3"
                },
                {
                    "introduced": "3.5"
                },
                {
                    "fixed": "3.5.11"
                },
                {
                    "introduced": "3.4"
                },
                {
                    "fixed": "3.4.15"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cwe_ids": [
        "CWE-288"
    ],
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22731.json"
}
References

Affected packages

Git / github.com/spring-projects/spring-boot

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-boot
Events
Introduced
8c2d6453243f319accaef7a190ff8ddf89f482a2
Fixed
285b0743a96f20042ec3578397f40538ff175e2e
Introduced
1c0e08b4c434b0e77a83098267b2a0f5a3fc56d7
Fixed
8bdd6f836a4f6041b34e788dccda45e4653e82a4
Database specific 
{
    "cpe": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.5.0"
        },
        {
            "fixed": "3.5.12"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.4"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22731.json"