CVE-2026-22731

HIGH

Authentication Bypass under Actuator Health groups paths

Title source: cna

Description

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

References (1)

https://spring.io/security/cve-2026-22731

Scores

CVSS v3 8.2

EPSS 0.0003

EPSS Percentile 7.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-288 CWE-306

Status published

Products (5)

org.springframework.boot/spring-boot-starter-actuator 3.4.0Maven

Spring/Spring Boot 3.4 - 3.4.15

Spring/Spring Boot 3.5 - 3.5.11

Spring/Spring Boot 4.0 - 4.0.3

vmware/spring_boot 3.4.0 - 3.4.15

Published Mar 19, 2026

Tracked Since Mar 20, 2026