{"id":"CVE-2026-22754","aliases":["EUVD-2026-24612","GHSA-4vrc-j85c-598c","ROOT-APP-MAVEN-CVE-2026-22754"],"status":"published","title":"ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules","description":"Vulnerability in Spring Spring Security. If an application uses \u003csec:intercept-url servlet-path=\"/servlet-path\" pattern=\"/endpoint/**\"/\u003e to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00266,"percentile":0.18868,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284","CWE-551"],"published":"2026-04-22T05:32:48Z","modified":"2026-10-28T02:30:27Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-config","fixed_in":["7.0.5"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-config","fixed_in":["7.0.4-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-config","fixed_in":["7.0.4-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.4"},{"fixed":"7.0.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.5"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.3","7.0.4"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4-root.io.1"}]}]}],"products":[{"vendor":"red hat","product":"openshift developer tools and services"},{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat build of apache camel for spring boot 4"},{"vendor":"red hat","product":"red hat build of quarkus"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat openshift dev spaces"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"spring","product":"spring security"},{"vendor":"vmware","product":"spring_security"}],"references":[{"url":"https://spring.io/security/cve-2026-22754","tags":["Mitigation","Vendor Advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22754","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460489","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22754.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22754","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4vrc-j85c-598c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22754.json","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-security","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-22754","title":"ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules","description":"Vulnerability in Spring Spring Security. If an application uses \u003csec:intercept-url servlet-path=\"/servlet-path\" pattern=\"/endpoint/**\"/\u003e to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.","status":"published","published":"2026-04-22T05:32:48.172Z","modified":"2026-07-15T01:19:27.274Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-284","CWE-551"],"updated_at":"2026-11-02T13:39:16.730222Z"}],"euvd":[{"id":"EUVD-2026-24612","description":"Vulnerability in Spring Spring Security. If an application uses \u003csec:intercept-url servlet-path=\"/servlet-path\" pattern=\"/endpoint/**\"/\u003e to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.","status":"published","published":"2026-04-22T05:32:48Z","modified":"2026-07-15T01:19:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:55.318488Z"}],"ghsa":[{"id":"GHSA-4vrc-j85c-598c","title":"Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules","description":"Vulnerability in Spring Spring Security. If an application uses \u003csec:intercept-url servlet-path=\"/servlet-path\" pattern=\"/endpoint/**\"/\u003e to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass. This issue affects Spring Security: from 7.0.0 through 7.0.4.","status":"published","published":"2026-04-22T06:30:29Z","modified":"2026-04-29T20:50:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:39:59.776263Z"}],"nvd":[{"id":"CVE-2026-22754","description":"Vulnerability in Spring Spring Security. If an application uses \u003csec:intercept-url servlet-path=\"/servlet-path\" pattern=\"/endpoint/**\"/\u003e to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.","status":"published","published":"2026-04-22T06:16:04.27Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-284","CWE-551"],"updated_at":"2026-11-02T14:12:15.493943Z"}],"osv":[{"id":"CVE-2026-22754","title":"ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules","description":"Vulnerability in Spring Spring Security. If an application uses \u003csec:intercept-url servlet-path=\"/servlet-path\" pattern=\"/endpoint/**\"/\u003e to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.","status":"published","published":"2026-04-22T05:32:48.172Z","modified":"2026-10-28T02:30:27.064852086Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"GHSA-4vrc-j85c-598c","title":"Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules","description":"Vulnerability in Spring Spring Security. If an application uses \u003csec:intercept-url servlet-path=\"/servlet-path\" pattern=\"/endpoint/**\"/\u003e to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass. This issue affects Spring Security: from 7.0.0 through 7.0.4.","status":"published","published":"2026-04-22T06:30:29Z","modified":"2026-09-10T03:50:42.810803589Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-22754","title":"CVE-2026-22754 in org.springframework.security:spring-security-config - Patched by Root","description":"Root has patched CVE-2026-22754 in the org.springframework.security:spring-security-config package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-11T11:34:16Z","modified":"2026-09-11T12:15:03.033996184Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}