CVE-2026-22731
Fixed in a distro release EPSS <1%CVSS 8.2
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
Products: Spring Boot
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework.boot:spring-boot-starter-actuator | no fix |
| Maven | org.springframework.boot:spring-boot-starter-actuator | 3.5.12 |
| Maven | org.springframework.boot:spring-boot-starter-actuator | 4.0.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-nifi-registry | 2.8.0-r3 |
| Chainguard | camunda-8.8 | 8.8.22-r0 |
| Chainguard | camunda-zeebe-8.6 | 8.6.39-r0 |
| Chainguard | camunda-zeebe-8.7 | 8.7.27-r0 |
| Chainguard | camunda-zeebe-8.8 | 8.8.22-r0 |
| Wolfi | apache-nifi-registry | 2.8.0-r3 |