Spring BootFramework / library · VMware
CVE-2026-22731
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedSpring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceSpring Boot Actuator has an authentication bypass vulnerability where endpoints requiring authentication can be accessed without credentials when they share a path with a Health Group additional path configuration. The path matching logic incorrectly allows unauthenticated access to protected endpoints that overlap with health check path configurations.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
Spring BootFramework / library
>= 3.4.0, < 3.4.15>= 3.5.0, < 3.5.12>= 4.0.0, < 4.0.4CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- High
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed Spring Boot versionLocate the Spring Boot version in your project build file (pom.xml, build.gradle, build.gradle.kts) or in the MANIFEST.MF file within the application JAR. Look for the 'Implementation-Version' or 'Spring-Boot-Version' attribute.Affected if The version is >= 3.4.0 and < 3.4.15, OR >= 3.5.0 and < 3.5.12, OR >= 4.0.0 and < 4.0.4
-
Verify Spring Boot Actuator is enabledConfirm that spring-boot-starter-actuator is present in your dependencies (pom.xml, build.gradle). Also check that no explicit exclusion of actuator endpoints exists in your configuration.Affected if Actuator is on the classpath and endpoints are exposed (even if restricted)
-
Inspect Health Group path configurationsReview your application.properties or application.yml for any management.endpoint.health.group.* configurations, especially group-specific additional paths such as management.endpoint.health.group.custom.path or similar settings that define custom health check paths.Affected if Any Health Group is configured with a custom additional path that overlaps with other endpoint paths
-
Review endpoint exposure settingsCheck management.endpoints.web.exposure.include and management.endpoints.web.exposure.exclude properties in your configuration files to see which endpoints are exposed and whether authentication is required via management.endpoints.web.base-path and endpoint-specific access settings.Affected if Sensitive endpoints (such as env, beans, heapdump, etc.) are exposed without requiring authentication and share path segments with Health Group configurations
-
Audit endpoint path mappingsCompare the paths configured for Health Groups against all explicitly configured custom endpoint paths in your application. Look for any path overlap or prefix matching that could cause path matching ambiguity.Affected if There exists any path overlap between a Health Group additional path and a protected endpoint path
You are affected if your Spring Boot version falls within the vulnerable ranges AND you have Health Group additional path configurations that share paths with authentication-protected actuator endpoints.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped3.4.153.5.124.0.4
Upgrade to Spring Boot 4.0.3, 3.5.11, or 3.4.15 or later, or audit endpoint path configurations to ensure authenticated endpoints do not use paths configured for Health Group additional paths.
Spring Boot 3.4.15, 3.5.12, or 4.0.4 (depending on your current major version)
- 1. Identify the current Spring Boot version in your project's pom.xml or build.gradle file.
- 2. Determine the appropriate upgrade target based on your current major version: upgrade to 3.4.15 for Spring Boot 3.4.x, upgrade to 3.5.12 for Spring Boot 3.5.x, or upgrade to 4.0.4 for Spring Boot 4.0.x.
- 3. Update the Spring Boot version in your build configuration: change the spring-boot.version property or plugin version to the target fixed version.
- 4. Rebuild and test the application to verify the upgrade does not introduce regressions.
- 5. Verify that Actuator endpoints with custom paths are properly secured and authentication is enforced as expected.
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Spring Boot
Scoped from the published advisory
- Consultation4.0 h
- Implementation6.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,544.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-22731 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-22731 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data