VDB
Sign up
HIGH8.2

GHSA-8hfc-fq58-r658

Spring Boot has an Authentication Bypass under Actuator Health groups paths

Quick fix

GHSA-8hfc-fq58-r658 — org.springframework.boot:spring-boot-starter-actuator: upgrade to the fixed version with the command below.

# pom.xml: bump <version>3.5.12</version> for org.springframework.boot:spring-boot-starter-actuator

Details

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.springframework.boot:spring-boot-starter-actuator
Introduced in: 3.4.0

No fixed version published yet for org.springframework.boot:spring-boot-starter-actuator (maven). Pin to a known-safe version or switch to an alternative.

Maven/org.springframework.boot:spring-boot-starter-actuator
Introduced in: 3.5.0Fixed in: 3.5.12
Fix# pom.xml: bump <version>3.5.12</version> for org.springframework.boot:spring-boot-starter-actuator
Maven/org.springframework.boot:spring-boot-starter-actuator
Introduced in: 4.0.0-M1Fixed in: 4.0.4
Fix# pom.xml: bump <version>4.0.4</version> for org.springframework.boot:spring-boot-starter-actuator

References