9.1
Critique
CVE-2026-40976 In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all…
Description
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Boot 4.0 | 4.0.0 → < 4.0.6 | 4.0.6 |
| Red Hat Data Grid 8 | Versions non publiées | |
| Red Hat AMQ Broker 7 | Versions non publiées | |
| Red Hat AMQ Clients | Versions non publiées | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions non publiées | |
| Red Hat build of Apache Camel for Spring Boot 4 | Versions non publiées | |
| Red Hat build of OptaPlanner 8 | Versions non publiées | |
| Red Hat Enterprise Linux 8 | Versions non publiées | |
| Red Hat Enterprise Linux 9 | Versions non publiées |
Afficher les 7 autres branches Masquer les 7 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Fuse 7 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions non publiées | |
| Red Hat OpenShift Dev Spaces | Versions non publiées | |
| Red Hat Process Automation 7 | Versions non publiées | |
| Red Hat Single Sign-On 7 | Versions non publiées |
Références
- spring.io spring.io
Chronologie
- Publiée
- Dernière modification
Autres CVE de Spring Boot
Les 15 CVE de Spring Boot →
CVE-2026-41001
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's…
5.3
Moyenne
CVE-2026-40992
Spring Boot's Mail auto-configuration does not enable hostname verification
5.0
Moyenne
CVE-2026-40977
When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID…
4.7
Moyenne
CVE-2026-40975
Values produced by ${random.value} are not suitable for use as secrets
4.8
Moyenne