9.1
Critical
CVE-2026-40976 In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all…
Description
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Boot 4.0 | 4.0.0 → < 4.0.6 | 4.0.6 |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat AMQ Broker 7 | Versions not published | |
| Red Hat AMQ Clients | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat build of Apache Camel for Spring Boot 4 | Versions not published | |
| Red Hat build of OptaPlanner 8 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published |
Show the 7 other branches Hide the 7 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Fuse 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat Process Automation 7 | Versions not published | |
| Red Hat Single Sign-On 7 | Versions not published |
References
- spring.io spring.io
Timeline
- Published
- Last modified
Other CVEs of Spring Boot
The 15 CVEs of Spring Boot →
CVE-2026-41001
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's…
5.3
Medium
CVE-2026-40992
Spring Boot's Mail auto-configuration does not enable hostname verification
5.0
Medium
CVE-2026-40977
When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID…
4.7
Medium
CVE-2026-40975
Values produced by ${random.value} are not suitable for use as secrets
4.8
Medium