Skip to content

[GHSA-mgvc-8q2h-5pgc] Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints #7218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
yeikel wants to merge 1 commit into
base: yeikel/advisory-improvement-7218
Choose a base branch
from
+2 −2
Open

[GHSA-mgvc-8q2h-5pgc] Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints #7218

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions advisories/github-reviewed/2026/03/GHSA-mgvc-8q2h-5pgc/GHSA-mgvc-8q2h-5pgc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mgvc-8q2h-5pgc",
"modified": "2026-03-20T20:42:31Z",
"modified": "2026-03-20T20:42:32Z",
"published": "2026-03-20T00:31:28Z",
"aliases": [
"CVE-2026-22733"
],
"summary": "Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints",
"details": "Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.",
"details": "Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.\n\nMore precisely, an application can be vulnerable when all the following are true:\n\n- the application is a web application\n- the application has the Actuator dependency on the classpath\n- the application has the Spring Security dependency on the classpath\n- the application contributes an application endpoint that requires authentication under a subpath, like \"/cloudfoundryapplication/admin\"\n\nNote that mapping application endpoints under infrastructure endpoints like Actuators is not recommended by the Spring team and that doing so is likely to interfere with other configurations and cause behavior problems. While the severity for this advisory is high, we expect this setup to rarely occur in production.\n\nThis CVE is similar but not equivalent to CVE-2026-22731, as the conditions for exploit and vulnerable versions are different.\n\n## Mitigation\nUsers of affected versions should upgrade to the corresponding fixed version.",
"severity": [
{
"type": "CVSS_V3",
Expand Down
Loading