CVE-2026-22733: Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints

March 20, 2026

Spring Boot applications with Actuator can be vulnerable to an “Authentication Bypass” vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.

References

github.com/advisories/GHSA-mgvc-8q2h-5pgc
github.com/spring-projects/spring-boot
nvd.nist.gov/vuln/detail/CVE-2026-22733
spring.io/security/cve-2026-22733

Code Behaviors & Features

Detect and mitigate CVE-2026-22733 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →