CVE-2026-22754: Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules

April 22, 2026 (updated April 29, 2026)

Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass. This issue affects Spring Security: from 7.0.0 through 7.0.4.

References

github.com/advisories/GHSA-4vrc-j85c-598c
nvd.nist.gov/vuln/detail/CVE-2026-22754
spring.io/security/cve-2026-22754

Code Behaviors & Features

Detect and mitigate CVE-2026-22754 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →