{"id":"CVE-2026-22731","aliases":["CLSA-2026-1783558974","CLSA-2026-1787144370","CLSA-2026-1787144963","CLSA-2026-1787145317","EUVD-2026-13345","GHSA-8hfc-fq58-r658","ROOT-APP-MAVEN-CVE-2026-22731"],"status":"published","title":"Authentication Bypass under Actuator Health groups paths","description":"Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.\nThis issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.\nThis CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00347,"percentile":0.2869,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-288","CWE-306"],"published":"2026-03-19T22:36:15Z","modified":"2026-11-02T19:45:41Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.boot:spring-boot-starter-actuator","fixed_in":["3.5.12","4.0.4"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.boot:spring-boot-starter-actuator","fixed_in":["3.4.4-root.io.1","3.4.4-root.io.2","3.4.4-root.io.5","3.4.4-root.io.6","3.4.4-root.io.7"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","fixed_in":["3.4.4-aikido.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"last_affected":"3.4.13"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.12"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-M1"},{"fixed":"4.0.4"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.13"},{"fixed":"3.4.13-tuxcare.1"}]}],"versions":["3.4.13"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.13"},{"fixed":"3.4.13-tuxcare.1"}]}],"versions":["3.4.13"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.13"},{"fixed":"3.4.13-tuxcare.1"}]}],"versions":["3.4.13"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.13"},{"fixed":"3.4.13-tuxcare.1"}]}],"versions":["3.4.13"],"bundled":4},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"last_affected":"3.4.13"}]}],"versions":["3.4.0","3.4.1","3.4.10","3.4.11","3.4.12","3.4.13","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.12"}]}],"versions":["3.5.0","3.5.1","3.5.10","3.5.11","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-M1"},{"fixed":"4.0.4"}]}],"versions":["4.0.0","4.0.0-M1","4.0.0-M2","4.0.0-M3","4.0.0-RC1","4.0.0-RC2","4.0.1","4.0.2","4.0.3"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-root.io.1"},{"fixed":"3.4.4-root.io.2"},{"fixed":"3.4.4-root.io.5"},{"fixed":"3.4.4-root.io.6"},{"fixed":"3.4.4-root.io.7"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-aikido.7"}]}]}],"products":[{"vendor":"spring","product":"spring boot"},{"vendor":"vmware","product":"spring_boot"}],"references":[{"url":"https://spring.io/security/cve-2026-22731","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22731","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8hfc-fq58-r658"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22731.json","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-boot","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-22731","title":"Authentication Bypass under Actuator Health groups paths","description":"Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.\nThis issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.\nThis CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.","status":"published","published":"2026-03-19T22:36:15.112Z","modified":"2026-03-20T15:33:43.191Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T13:39:16.730222Z"}],"euvd":[{"id":"EUVD-2026-13345","description":"Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.\nThis issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.\nThis CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.","status":"published","published":"2026-03-19T22:36:15Z","modified":"2026-03-20T15:33:43Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T19:25:32.430758Z"}],"ghsa":[{"id":"GHSA-8hfc-fq58-r658","title":"Spring Boot has an Authentication Bypass under Actuator Health groups paths","description":"Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.\nThis issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.\nThis CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.","status":"published","published":"2026-03-20T00:31:28Z","modified":"2026-04-16T21:58:13Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-288","CWE-306"],"updated_at":"2026-11-02T14:39:55.105822Z"}],"nvd":[{"id":"CVE-2026-22731","description":"Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.\nThis issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.\nThis CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.","status":"published","published":"2026-03-19T23:16:41.08Z","modified":"2026-06-17T10:20:18.777Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-288","CWE-306"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"CVE-2026-22731","title":"Authentication Bypass under Actuator Health groups paths","description":"Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.\nThis issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.\nThis CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.","status":"published","published":"2026-03-19T22:36:15.112Z","modified":"2026-10-28T02:30:55.759683604Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"GHSA-8hfc-fq58-r658","title":"Spring Boot has an Authentication Bypass under Actuator Health groups paths","description":"Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.\nThis issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.\nThis CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.","status":"published","published":"2026-03-20T00:31:28Z","modified":"2026-09-10T03:50:38.468261195Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-288","CWE-306"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"CLSA-2026-1783558974","title":"TuxCare security update for org.springframework.boot (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.boot packages to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.","status":"published","published":"2026-08-04T14:52:42Z","modified":"2026-11-02T19:45:41.834532071Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1787144370","title":"TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.","status":"withdrawn","published":"2026-08-19T12:59:30Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787144963","title":"TuxCare security update for org.springframework.data (4 CVEs)","description":"TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.","status":"withdrawn","published":"2026-08-19T13:09:23Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787145317","title":"TuxCare security update for org.springframework.data (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.data packages to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.","status":"withdrawn","published":"2026-08-19T13:15:17Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-22731","title":"CVE-2026-22731 in io.root.org.springframework.boot:spring-boot-starter-actuator - Patched by Root","description":"Root has patched CVE-2026-22731 in the io.root.org.springframework.boot:spring-boot-starter-actuator package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-18T09:49:29Z","modified":"2026-06-18T13:45:20.080433455Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}