Improper access control in Spring Framework - CVE-2026-41841
Published: August 28, 2026
Vulnerability identifier: #VU146169
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41841
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in the static resource cache in Spring MVC and Spring WebFlux when resolving static resources. A remote attacker can request a publicly available resource with the same name as a protected resource to disclose sensitive information.
Exploitation requires several resource handlers using different resource locations, at least one protected resource handler, and a shared cache across these configurations.
Affected software
Spring Framework
Db2 Developer Extension
IBM Sterling B2B Integrator
IBM Sterling File Gateway
Db2 Developer Extension
IBM Sterling B2B Integrator
IBM Sterling File Gateway
How to mitigate CVE-2026-41841
Install security update from vendor's website.
Spring Framework - addressed in versions 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8
Db2 Developer Extension - update to 1.2.0
IBM Sterling B2B Integrator - addressed in versions 6.2.1.2.1, 6.2.2.1.1
IBM Sterling File Gateway - addressed in versions 6.2.1.2.1, 6.2.2.1.1
Db2 Developer Extension - update to 1.2.0
IBM Sterling B2B Integrator - addressed in versions 6.2.1.2.1, 6.2.2.1.1
IBM Sterling File Gateway - addressed in versions 6.2.1.2.1, 6.2.2.1.1