CVE-2026-22731: Spring Boot Actuator Authentication Bypass Vulnerability
Summary
CVE-2026-22731: Spring Boot has an Authentication Bypass under Actuator Health groups paths. Affects org.springframework.boot:spring-boot-starter-actuator across 3 version ranges.
>= 3.4.0, <= 3.4.13
>= 3.5.0, < 3.5.12
>= 4.0.0-M1, < 4.0.4
Fixed in 3.5.12 or 4.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Boot is a popular framework used for building Java-based applications. It simplifies the development process by providing a range of features, including embedded servers, dependency management, and production-ready features like Actuator. The Actuator module allows developers to monitor and manage their applications, exposing various endpoints for health checks and metrics. However, certain configurations can lead to vulnerabilities, such as the Authentication Bypass issue identified in this report.
Vulnerability Detail
The vulnerability arises in Spring Boot applications that utilize the Actuator module. Specifically, when an endpoint requiring authentication is declared under a path that is also configured for a Health Group additional path, it can lead to an Authentication Bypass. This means that unauthorized users may gain access to sensitive application information, potentially compromising the security of the application. The issue affects specific versions of Spring Boot, making it critical for users to be aware of their current version and the associated risks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.5.0, < 3.5.123.5.12 -
>= 4.0.0-M1, < 4.0.44.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can restrict access to the vulnerable endpoints by implementing additional security configurations in your application. This may involve modifying your security settings to ensure that sensitive endpoints are not exposed without proper authentication.
Conclusion
In summary, CVE-2026-22731 is a significant vulnerability affecting specific versions of Spring Boot's Actuator module, allowing for potential authentication bypass. It is crucial for developers to update their dependencies to the patched versions to mitigate risks and ensure the security of their applications.
See every vulnerability recorded for org.springframework.boot:spring-boot-starter-actuator →
FAQ
CVE-2026-22731 is a vulnerability in Spring Boot that allows for authentication bypass in applications using the Actuator module under specific conditions.
The vulnerability affects Spring Boot versions 3.4.0 to 3.4.13, 3.5.0 to 3.5.11, and 4.0.0-M1 to 4.0.3.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing your pom.xml file. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for CVE-2026-22731 is 8.2, indicating a high severity level.
If immediate updates are not possible, consider implementing additional security measures to restrict access to sensitive endpoints as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.boot:spring-boot-starter-actuator.
