CVE-2026-22733 HIGH

CVE-2026-22733: Authentication Bypass under Actuator CloudFoundry endpoints

Vendor Spring
Product Spring Security
Weakness CWE-288
Published March 19, 2026
Last update March 20, 2026

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.

Key dates

02Disclosure timeline

March 19, 2026 CVE published
March 20, 2026 Record updated