Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.
More precisely, an application can be vulnerable when all the following are true:
"mygroup"), with management.endpoint.health.group.mygroup.includemanagement.endpoint.health.group.mygroup.additional-path=server:/healthz"/healthz/admin"Note that mapping application endpoints under infrastructure endpoints like Actuators is not recommended by the Spring team and that doing so is likely to interfere with other configurations and cause behavior problems. While the severity for this advisory is high, we expect this setup to rarely occur in production.
This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
Spring Boot:
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 4.0.x | 4.0.4 | OSS |
| 3.5.x | 3.5.12 | OSS |
| 3.4.x | 3.4.15 | Commercial |
No further mitigation steps are necessary.
This issue was responsibly reported by Gyu-hyeok Lee (g2h).
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。