CVE-2026-40976: CWE-862: Missing Authorization in Spring Spring Boot
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
AI Analysis
Technical Summary
This vulnerability arises from missing authorization controls in Spring Boot's default web security configuration. Applications that are servlet-based, have no custom Spring Security configuration, depend on spring-boot-actuator-autoconfigure, and do not depend on spring-boot-health are vulnerable. Under these conditions, the default security filter chain is ineffective, permitting unauthorized access to all endpoints. The issue affects Spring Boot versions 4.0.0 through 4.0.5. The vendor advisory from Red Hat recommends upgrading to version 4.0.6 or later to remediate the vulnerability.
Potential Impact
Successful exploitation allows an unauthenticated attacker to gain unauthorized access to all endpoints of the affected Spring Boot application, leading to complete confidentiality and integrity compromise of the application data and functionality. Availability is not impacted. The CVSS v3.1 base score is 9.1, indicating critical severity.
Mitigation Recommendations
A fix is available by upgrading to Spring Boot version 4.0.6 or later as per the vendor advisory. Applications should verify their Spring Security configurations and avoid relying solely on the default security filter chain if they depend on spring-boot-actuator-autoconfigure and do not depend on spring-boot-health. Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-40976 for detailed remediation guidance.
CVE-2026-40976: CWE-862: Missing Authorization in Spring Spring Boot
Description
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
CVSS v3.1
Score 9.1critical
Affected software
pkg:maven/org.springframework.boot/spring-bootRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from missing authorization controls in Spring Boot's default web security configuration. Applications that are servlet-based, have no custom Spring Security configuration, depend on spring-boot-actuator-autoconfigure, and do not depend on spring-boot-health are vulnerable. Under these conditions, the default security filter chain is ineffective, permitting unauthorized access to all endpoints. The issue affects Spring Boot versions 4.0.0 through 4.0.5. The vendor advisory from Red Hat recommends upgrading to version 4.0.6 or later to remediate the vulnerability.
Potential Impact
Successful exploitation allows an unauthenticated attacker to gain unauthorized access to all endpoints of the affected Spring Boot application, leading to complete confidentiality and integrity compromise of the application data and functionality. Availability is not impacted. The CVSS v3.1 base score is 9.1, indicating critical severity.
Mitigation Recommendations
A fix is available by upgrading to Spring Boot version 4.0.6 or later as per the vendor advisory. Applications should verify their Spring Security configurations and avoid relying solely on the default security filter chain if they depend on spring-boot-actuator-autoconfigure and do not depend on spring-boot-health. Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-40976 for detailed remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- vmware
- Date Reserved
- 2026-04-16T02:19:04.616Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-40976","vendor":"Red Hat"}]
Threat ID: 69f0134ecbff5d861057a5d1
Added to database: 04/28/2026, 01:54:22 UTC
Last enriched: 07/15/2026, 09:13:06 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 231
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.