CVE-2026-22747
Fixed in a distro release EPSS <1%CVSS 6.8
Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.
Products: Spring Security, Red Hat OpenShift Developer Tools and Services, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift Dev Spaces, Red Hat Process Automation 7, Red Hat Single Sign-On 7
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework.security:spring-security-web | 7.0.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-nifi | 2.9.0-r3 |
| Chainguard | apache-nifi-registry | 2.9.0-r6 |
| Chainguard | camunda-zeebe-8.9 | 8.9.1-r2 |
| Wolfi | apache-nifi | 2.9.0-r3 |
| Wolfi | apache-nifi-registry | 2.9.0-r6 |