Vulnerability Directory | CVE-2026-22733 | Spring

Overview

Spring Boot is a convention-over-configuration framework built on top of the Spring Framework that simplifies the creation of production-grade, stand-alone Java applications. It provides auto-configuration, embedded web servers, and integrated actuator endpoints for monitoring and managing deployed applications.

A high-severity authorization bypass vulnerability (CVE-2026-22733) has been identified in Spring Boot's CloudFoundry Actuator integration. The Servlet and Reactive CloudFoundry Actuator handler mappings only registered handlers for known Actuator endpoints under the /cloudfoundryapplication namespace. Requests targeting non-existent or unregistered paths under this namespace were not handled by the CloudFoundry handler mapping and could fall through to other handler mappings in the application. Combined with the permissive Spring Security configuration for the CloudFoundry path, an attacker could exploit this by crafting requests to arbitrary paths under /cloudfoundryapplication/ that would be routed to application controllers while bypassing the intended access controls.

Per OWASP: Broken Access Control occurs when "access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data, or performing a business function outside of the user's limits."

This issue affects all versions of Spring Boot that include CloudFoundry Actuator support.

‍

Details

Module Info

Product: Spring Boot
Affected packages: spring-boot-actuator-autoconfigure, spring-boot-actuator
Affected versions: >=2.0.0 <3.5.12, >=4.0.0 <4.0.4
GitHub repository: https://github.com/spring-projects/spring-boot
Published packages: https://central.sonatype.com/artifact/org.springframework.boot/spring-boot-actuator-autoconfigure
Package manager: Maven
Fixed in:
- OSS versions: 3.5.12, 4.0.4
- NES for Spring Boot

‍

Vulnerability Info

This high-severity vulnerability is found in the CloudFoundry Actuator handler mapping classes within the spring-boot-actuator-autoconfigure module across all published versions of Spring Boot prior to the fix.

Spring Boot provides Cloud Foundry-specific actuator support through the /cloudfoundryapplication URL namespace. When a Spring Boot application is deployed to Cloud Foundry (or has the Cloud Foundry actuator integration enabled), this path allows Cloud Foundry management UIs to access actuator endpoints such as /cloudfoundryapplication/health and /cloudfoundryapplication/info. The namespace is protected by a dedicated CloudFoundrySecurityInterceptor that validates requests against the Cloud Foundry UAA (User Account and Authentication) server, and Spring Security is configured to permit requests under this path so that the CloudFoundry-specific authentication mechanism takes precedence.

Prior to the fix, the CloudFoundryWebEndpointServletHandlerMapping (Servlet) and CloudFoundryWebFluxEndpointHandlerMapping (Reactive) classes only registered handler methods for known actuator endpoints. The Spring Security filter chain was also dynamically scoped to only match paths corresponding to registered endpoints. This meant that any request targeting an unrecognized path under /cloudfoundryapplication/ (e.g., /cloudfoundryapplication/unknown) would:

Not be matched by the CloudFoundry handler mapping, causing it to fall through to other handler mappings in the application.
Not be matched by the CloudFoundry-specific Spring Security filter chain, potentially being handled by a different security configuration or no security configuration at all.

If the application has a catch-all request mapping (e.g., /**), these unmapped CloudFoundry-namespace requests could be routed to application controllers without the CloudFoundry authentication checks or the intended Spring Security restrictions being applied.

This vulnerability is related to the earlier CVE-2023-20873 ("Security Bypass With Wildcard Pattern Matching on Cloud Foundry", CVSS 9.8 Critical), which addressed a similar bypass in the same component. The fix for CVE-2023-20873 restricted access to known endpoint paths, but did not address the gap where paths not corresponding to any registered endpoint were left unhandled.

An application is vulnerable when all of the following conditions are met:

The application uses Spring Boot Actuator with Cloud Foundry support enabled (this is the default when deployed to Cloud Foundry)
The application has handler mappings that could process requests beyond the actuator namespace (e.g., a catch-all /** mapping)
The application relies on Spring Security to restrict access to certain endpoints

‍