CVE-2026-22746
Fixed in a distro release EPSS <1%CVSS 3.7
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Products: Spring Security
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework.security:spring-security-core | no fix |
| Maven | org.springframework.security:spring-security-core | 6.5.10 |
| Maven | org.springframework.security:spring-security-core | 7.0.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-nifi | 2.9.0-r3 |
| Chainguard | camunda-8.8 | 8.8.24-r0 |
| Chainguard | camunda-zeebe-8.6 | 8.6.40-r0 |
| Chainguard | camunda-zeebe-8.7 | 8.7.29-r0 |
| Chainguard | camunda-zeebe-8.8 | 8.8.24-r0 |
| Chainguard | camunda-zeebe-8.9 | 8.9.5-r0 |
| Chainguard | conductor | 3.31.0-r4 |
| Chainguard | conductor-fips | 3.31.0-r5 |
| Chainguard | geoserver-2.27 | no fix |
| Chainguard | geoserver-2.28 | no fix |
| Chainguard | jenkins-2-openjdk-21 | 2.555.1-r1 |
| Chainguard | jenkins-2-openjdk-25 | 2.555.1-r1 |
| Chainguard | jenkins-2.528-openjdk-17 | no fix |
| Chainguard | jenkins-2.528-openjdk-21 | no fix |
| Chainguard | jenkins-2.541 | 2.541.3-r3 |
| Chainguard | jenkins-2.541-openjdk-17 | 2.541.3-r3 |
| Chainguard | jenkins-2.541-openjdk-21 | 2.541.3-r3 |
| Chainguard | kafbat-ui | 1.4.2-r9 |
| Chainguard | kafbat-ui-fips | 1.4.2-r8 |
| Chainguard | kayenta-2025.0 | no fix |
| Chainguard | kayenta-2025.1 | no fix |
| Chainguard | kayenta-2025.2 | no fix |
| Chainguard | kayenta-fips-2025.0 | no fix |
| Chainguard | kayenta-fips-2025.1 | no fix |
| Chainguard | kayenta-fips-2025.2 | no fix |
| Chainguard | nacos | 3.2.1-r2 |
| Chainguard | nacos-docker | 3.2.1-r1 |
| Chainguard | ranger | no fix |
| Chainguard | thingsboard-tb-node | 4.3.1.1-r11 |
| Wolfi | apache-nifi | 2.9.0-r3 |
| Wolfi | jenkins-2-openjdk-21 | 2.555.1-r1 |
| Wolfi | jenkins-2-openjdk-25 | 2.555.1-r1 |
| Wolfi | thingsboard-tb-node | 4.3.1.1-r11 |