Improper access control in Spring Boot - CVE-2026-40976
Published: April 27, 2026
Vulnerability identifier: #VU128236
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40976
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to all endpoints.
The vulnerability exists due to improper access control in the default web security filter chain when handling requests in certain actuator configurations. A remote attacker can send requests to application endpoints to gain unauthorized access to all endpoints.
Only servlet-based web applications that rely on the default web security filter chain, depend on spring-boot-actuator-autoconfigure, and do not depend on spring-boot-health are vulnerable.
Affected software
Spring Boot
How to mitigate CVE-2026-40976
Install security update from vendor's website.
Spring Boot - update to 4.0.6