GHSA-8hfc-fq58-r658
Spring Boot has an Authentication Bypass under Actuator Health groups paths
Quick fix
GHSA-8hfc-fq58-r658 — org.springframework.boot:spring-boot-starter-actuator: upgrade to the fixed version with the command below.
# pom.xml: bump <version>3.5.12</version> for org.springframework.boot:spring-boot-starter-actuatorDetails
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
Are you affected?
Enter the version of the package you're using.
Affected packages
3.4.0No fixed version published yet for org.springframework.boot:spring-boot-starter-actuator (maven). Pin to a known-safe version or switch to an alternative.
3.5.0Fixed in: 3.5.12# pom.xml: bump <version>3.5.12</version> for org.springframework.boot:spring-boot-starter-actuator4.0.0-M1Fixed in: 4.0.4# pom.xml: bump <version>4.0.4</version> for org.springframework.boot:spring-boot-starter-actuator