CVE-2026-40976

Spring Boot: Spring Boot: Security bypass due to ineffective default web security

Published Apr 27, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.

Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

Analysis

Technical impact

The vulnerability occurs when a Spring Boot application that is servlet‑based, uses the default web security filter chain without any custom Spring Security configuration, includes spring‑boot‑actuator‑autoconfigure, but does not depend on spring‑boot‑health. Under these circumstances the default security is ineffective, allowing an unauthenticated user to reach every endpoint of the application. This missing authorization flaw (CWE‑862) and the insecure default configuration (CWE‑305) can expose or modify sensitive data and services, making the application vulnerable to unauthorized exploitation.

Affected Systems

Spring Boot versions 4.0.0 through 4.0.5 are vulnerable if the application meets the above conditions. Updating to 4.0.6 or later addresses the issue.

Risk and Exploitability

The CVSS score of 9.1 indicates critical severity. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is exploiting the default filter chain by sending HTTP requests to any endpoint without authentication, which is feasible for an attacker who can reach the application over the network.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Spring

Spring Boot

unaffected

Version	Status	Constraints
`4.0.0`	affected	< 4.0.6

Configuration 1 [-]

cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Spring

Spring Boot

Version	Status	Scheme	Platform
`[4.0.0,4.0.6)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Spring Boot to version 4.0.6 or later.
Add explicit Spring Security configuration to enforce authentication and authorization if upgrading is not immediately possible.
If custom security is required but cannot be added, disable spring‑boot‑actuator‑autoconfigure or remove its dependency.

Generated by OpenCVE AI on May 14, 2026 at 14:21 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-8v8j-3hxp-93wr	Spring Boot's default security filter chain has no authorization rule with Actuator but without Health

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.489% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-40976
https://bugzilla.redhat.com/show_bug.cgi?id=2463322
https://nvd.nist.gov/vuln/detail/CVE-2026-40976
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40976.json
https://spring.io/security/cve-2026-40976
https://www.cve.org/CVERecord?id=CVE-2026-40976

History

May 14, 2026 12:15 PM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	Default Web Security Misconfiguration in Spring Boot	Spring Boot: Spring Boot: Security bypass due to ineffective default web security
Weaknesses		CWE-305
References		https://nvd.nist.gov/vuln/detail/CVE-2026-40976 https://www.cve.org/CVERecord?id=CVE-2026-40976
Metrics	threat_severity `None`	threat_severity `Important`

Apr 30, 2026 2:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Vmware Vmware spring Boot
CPEs		cpe:2.3:a:vmware:spring_boot::::::::
Vendors & Products		Vmware Vmware spring Boot

Apr 28, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 28, 2026 1:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		Default Web Security Misconfiguration in Spring Boot

Apr 28, 2026 4:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Spring Spring spring Boot
Vendors & Products		Spring Spring spring Boot

Apr 27, 2026 11:45 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Weaknesses		CWE-862
References		https://spring.io/security/cve-2026-40976
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`