High severity · published Mar 19, 2026
CVE-2026-22733
Authentication Bypass under Actuator CloudFoundry endpoints
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Spring Security · Spring
4.0.0 through 4.0.3; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.17; 2.7.0 through 2.7.31 · source: vendor
SB
Spring Boot · Vmware
before 2.7.32; 3.3.0 before 3.3.18; 3.4.0 before 3.4.15; 3.5.0 before 3.5.12; 4.0.0 before 4.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22733
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22733
Vendor Advisory
https://spring.io/security/cve-2026-22733
More from Spring Security
9.1
CVE-2026-59270
Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
9.1
CVE-2025-41232
CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods
8.1
CVE-2026-47838
Unauthorized User Impersonation when Using X.509 Client Certificates
8.1
CVE-2026-22747
Unauthorized User Impersonation when Using X.509 Client Certificates
7.5
CVE-2026-40988
Unbounded DEFLATE Inflation in SAML 2.0 Service Provider