Vulnerability Directory | CVE-2026-22731 | Spring

Overview

Spring Boot is the most widely used Java framework for building production-grade applications with minimal configuration. It provides embedded servers, auto-configuration, and production-ready features including Actuator endpoints for application monitoring and management.

A high-severity authentication bypass vulnerability (CVE-2026-22731) has been identified in Spring Boot's Actuator EndpointRequest request matcher. When an application configures a health group to be exposed under an additional path on the main server, the EndpointRequest matcher generates overly broad patterns that can match subpaths beneath the configured health group path. If the application also maps an application endpoint that requires authentication under one of these subpaths, the actuator security configuration (which typically permits unauthenticated access to health checks) takes precedence, allowing an unauthenticated remote attacker to access the protected endpoint.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects Spring Boot versions 3.4.0 through 3.4.14, 3.5.0 through 3.5.11, and 4.0.0 through 4.0.3.

‍

Details

Module Info

Product: Spring Boot
Affected packages: spring-boot-actuator-autoconfigure
Affected versions: >=3.4.0 <=3.4.14, >=3.5.0 <=3.5.11, >=4.0.0 <=4.0.3
GitHub repository: https://github.com/spring-projects/spring-boot
Published packages: https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-actuator-autoconfigure/
Package manager: Maven
Fixed in:
- Spring Boot 3.5.12, 4.0.4 (OSS)
- NES for Spring Boot

Vulnerability Info

This high-severity vulnerability is found in the EndpointRequest class within the spring-boot-actuator-autoconfigure module, affecting both the Servlet and Reactive variants.

Spring Boot Actuator allows applications to define health groups and expose them at additional paths using configuration properties such as:

management.endpoint.health.group.mygroup.include=*
management.endpoint.health.group.mygroup.additional-path=server:/healthz

‍

The EndpointRequest class is commonly used in Spring Security configurations to create request matchers for actuator endpoints. These matchers are then used to define security rules, such as permitting unauthenticated access to health endpoints.

An application is vulnerable when all of the following conditions are true:

The application has the Actuator dependency on the classpath
The application declares a custom health group with management.endpoint.health.group.<name>.include
The health group is exposed under an additional path on the main server, such as management.endpoint.health.group.<name>.additional-path=server:/healthz
The application maps an application endpoint that requires authentication under a subpath of the health group's additional path, such as /healthz/admin

In the vulnerable code, the createDelegate method in the EndpointRequest inner matcher class collected all additional health group paths into a LinkedHashSet<String> and then passed them to a separate getDelegateMatchers() method. This two-step process produced matchers that were overly broad, matching not only the configured path itself (e.g., /healthz) but also subpaths beneath it (e.g., /healthz/admin).

Vulnerable code (Servlet variant):

Set<String> paths = this.endpoints.stream()
    .filter(Objects::nonNull)
    .map(this::getEndpointId)
    .flatMap((endpointId) -> streamAdditionalPaths(endpoints, endpointId))
    .collect(Collectors.toCollection(LinkedHashSet::new));
List<RequestMatcher> delegateMatchers = getDelegateMatchers(
    requestMatcherFactory, matcherProvider, paths, this.httpMethod);

‍

Note: The Spring team states that mapping application endpoints under infrastructure endpoints like Actuators is not recommended and is likely to cause behavioral problems. While the severity is high, the specific configuration pattern required for exploitation is expected to be uncommon in production environments.

This CVE is related to, but distinct from, CVE-2026-22733, which addresses a similar authentication bypass under Actuator CloudFoundry endpoints. The two CVEs have different preconditions and affect different version ranges.

‍