CVE-2026-22733

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-227348.6Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems.CVE-2026-227352.6Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Found CVE-2026-227375.9Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclos CVE-2026-227389.8In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A ma CVE-2026-227398.6Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to th CVE-2026-22748.5A SSRF and Arbitrary File Read vulnerability in AppSheet Core in Google AppSheet prior to 2025-11-23 allows an authenticated remote attacker CVE-2026-227406.5A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp CVE-2026-227413.1Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can CVE-2026-227428.6Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing CVE-2026-227437.5Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled CVE-2026-227447.5In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, strin CVE-2026-227455.3Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an applic