Loading...
Skip to main content
GeekWala

CVE-2026-40976 — Vulnerability in...

CRITICAL

Spring Boot's default security filter chain has no authorization rule with Actuator but without Health

Published April 28, 2026Updated September 10, 2026Source: osv

Summary

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

Advisory Timeline

  • First published April 28, 2026 (167 days ago).
  • Last revised September 10, 2026 — 135 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.springframework.boot:spring-boot to 4.0.6 or later
<!-- Update pom.xml dependency version to 4.0.6 for org.springframework.boot:spring-boot -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
org.springframework.boot:spring-boot
maven
4.0.0, 4.0.1, 4.0.2, 4.0.3 (+2 more)4.0.6

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-862
    Missing AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Frequently Asked Questions

What is CVE-2026-40976?
Spring Boot's default security filter chain has no authorization rule with Actuator but without Health This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2026-40976?
CVE-2026-40976 affects org.springframework.boot:spring-boot. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-40976 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-8v8j-3hxp-93wr

Related CVEs

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies