CVE-2026-40976: Spring Boot Default Security Filter Chain Lacks Authorization for Actuator Endpoints
Summary
CVE-2026-40976: Spring Boot's default security filter chain has no authorization rule with Actuator but without Health. Affects org.springframework.boot:spring-boot versions >= 4.0.0, < 4.0.6. Fixed in 4.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Boot is a popular framework for building Java-based web applications. It simplifies the development process by providing a range of features, including auto-configuration, embedded servers, and production-ready features. The framework's actuator module offers production-ready features such as monitoring and management of applications. However, a vulnerability has been identified in the default security filter chain of Spring Boot, which can lead to unauthorized access to sensitive endpoints.
Vulnerability Detail
The vulnerability arises from the default web security configuration in Spring Boot, which does not enforce authorization rules for actuator endpoints when the health check feature is not included. This can result in unauthorized users gaining access to all actuator endpoints, potentially exposing sensitive application information. The conditions for vulnerability include being a servlet-based web application, lacking custom Spring Security configuration, relying on the default security filter chain, depending on spring-boot-actuator-autoconfigure, and not depending on spring-boot-health. The severity of this vulnerability is rated as critical, with a CVSS score of 9.1.
How To Fix
Minimum fixed version
4.0.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing custom Spring Security configurations to enforce authorization rules for actuator endpoints. This can be done by defining security settings in your application configuration to restrict access based on user roles.
Conclusion
In summary, CVE-2026-40976 presents a critical security risk for Spring Boot applications that do not implement custom security configurations. It is essential to upgrade to version 4.0.6 or later to mitigate this vulnerability and protect sensitive application data.
See every vulnerability recorded for org.springframework.boot:spring-boot →
FAQ
CVE-2026-40976 is a vulnerability in Spring Boot's default security filter chain that allows unauthorized access to actuator endpoints under certain conditions.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground without signup to test your application.
Actuator endpoints are part of the Spring Boot Actuator module that provides production-ready features such as monitoring and management of applications.
If upgrading is not feasible, implement custom Spring Security configurations to restrict access to actuator endpoints until you can upgrade.
The vulnerability has a critical severity rating with a CVSS score of 9.1, indicating a high risk of unauthorized access.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.boot:spring-boot.
