{"id":"CVE-2026-40976","aliases":["EUVD-2026-25940","GHSA-8v8j-3hxp-93wr","ROOT-APP-MAVEN-CVE-2026-40976"],"status":"published","title":"Spring Boot's default security filter chain has no authorization rule with Actuator but without Health","description":"In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.\n\nAffected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00489,"percentile":0.42359,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-305","CWE-862"],"published":"2026-04-27T23:34:51Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.boot:spring-boot","fixed_in":["4.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.boot:spring-boot","fixed_in":["4.0.5-aikido.2","4.0.5-aikido.3","4.0.6-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.boot:spring-boot","fixed_in":["4.0.5-root.io.1","4.0.5-root.io.2","4.0.5-root.io.3","4.0.6-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.6"}]}],"versions":["4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.5-aikido.2"},{"fixed":"4.0.5-aikido.3"},{"fixed":"4.0.6-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.5-root.io.1"},{"fixed":"4.0.5-root.io.2"},{"fixed":"4.0.5-root.io.3"},{"fixed":"4.0.6-root.io.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat amq broker 7"},{"vendor":"red hat","product":"red hat amq clients"},{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat build of apache camel for spring boot 4"},{"vendor":"red hat","product":"red hat build of optaplanner 8"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat openshift dev spaces"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"spring","product":"spring boot"},{"vendor":"vmware","product":"spring_boot"}],"references":[{"url":"https://spring.io/security/cve-2026-40976","tags":["Vendor Advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40976","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463322","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40976.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40976","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8v8j-3hxp-93wr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40976.json","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-boot","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-40976","description":"In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.\n\nAffected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.","status":"published","published":"2026-04-27T23:34:51.422Z","modified":"2026-07-15T01:00:17.23Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-862","CWE-305"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-25940","description":"In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.\n\nAffected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.","status":"published","published":"2026-04-27T23:34:51Z","modified":"2026-07-15T01:00:17Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:19:56.47701Z"}],"ghsa":[{"id":"GHSA-8v8j-3hxp-93wr","title":"Spring Boot's default security filter chain has no authorization rule with Actuator but without Health","description":"In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.\n\nAffected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.","status":"published","published":"2026-04-28T00:31:41Z","modified":"2026-05-06T18:54:08Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:40:01.917039Z"}],"nvd":[{"id":"CVE-2026-40976","description":"In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.\n\nAffected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.","status":"published","published":"2026-04-28T00:16:24.803Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-862","CWE-305"],"updated_at":"2026-11-02T14:12:16.252509Z"}],"osv":[{"id":"CVE-2026-40976","description":"In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.\n\nAffected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.","status":"published","published":"2026-04-27T23:34:51.422Z","modified":"2026-10-28T02:31:14.162193631Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"GHSA-8v8j-3hxp-93wr","title":"Spring Boot's default security filter chain has no authorization rule with Actuator but without Health","description":"In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.\n\nAffected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.","status":"published","published":"2026-04-28T00:31:41Z","modified":"2026-09-10T03:51:01.304654672Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-40976","title":"CVE-2026-40976 in org.springframework.boot:spring-boot - Patched by Root","description":"Root has patched CVE-2026-40976 in the org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-23T12:01:31Z","modified":"2026-09-23T13:15:03.410361708Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}