Critical

Spring Boot default security filter chain authorization bypass with Actuator but without Health

IdentifiersCVE-2026-40976CWE-862· Missing Authorization

CVE-2026-40976 is a missing-authorization vulnerability in Spring Boot’s default web security for certain servlet-based applications. In affected versions, a misplaced conditional check in the default management security auto-configuration can cause the authorization rules to be skipped when Actuator support is present but the spring-boot-health module is absent from the classpath. As a result, applications that rely entirely on Spring Boot’s default Spring Security filter chain may expose endpoints without authentication. The issue affects Spring Boot 4.0.0 through 4.0.5. The vulnerable condition requires a servlet-based web application with no custom Spring Security configuration, a dependency on spring-boot-actuator-autoconfigure, and no dependency on spring-boot-health. Under those conditions, the default security filter chain has no effective authorization rule, allowing unauthenticated access to application and management endpoints.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to access endpoints that should require authorization. Based on the provided context, exposed Actuator endpoints can include /actuator/env, /actuator/heapdump, /actuator/configprops, and /actuator/loggers. This can lead to disclosure of sensitive configuration and runtime data such as database credentials, API keys, JWT signing keys, session tokens, environment properties, and architectural details. Where writable endpoints such as /actuator/loggers are exposed, an attacker may also alter runtime logging behavior, potentially suppressing audit visibility or increasing logging to capture additional sensitive information. The provided CVSS context indicates high confidentiality and integrity impact, with no direct availability impact.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrade is not possible, avoid relying solely on Spring Boot’s default web security in the affected configuration. Add explicit Spring Security configuration that enforces authentication and authorization for all intended endpoints, especially Actuator endpoints. Ensure the application is not deployed in the vulnerable dependency state: specifically review whether spring-boot-actuator-autoconfigure is present while spring-boot-health is absent. Restrict network exposure of Actuator and application endpoints until patched.

Remediation

Patch, then assume compromise.

Upgrade Spring Boot to 4.0.6 or later, as advised by the vendor. The fix ensures that authentication requirements remain enforced even when the Health endpoint module is absent. If applicable to your release train, use a version that includes the vendor’s patch or forward port.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

BroadcomSpring Bootapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

17 SOURCESView more in app

cvefeed high severityNews

Apr 28, 2026

CVE-2026-40976 - "Spring Boot Default Web Security Bypass"

An authorization bypass vulnerability in Spring Boot where default web security can be ineffective under specific conditions, allowing unauthorized access to all endpoints.

zeropath blogNews

Apr 27, 2026

Spring Boot DevTools CVE-2026-40972: Brief Summary of a Timing Attack Leading to Remote Code Execution - ZeroPath Blog | ZeroPath

A critical vulnerability in Spring Boot described as the default security filter chain having no authorization rule with Actuator but without Health.

zeropath blogNews

Apr 27, 2026

Spring Boot CVE-2026-40976: Quick Look at a Critical Actuator Authorization Bypass in Versions 4.0.0 Through 4.0.5 - ZeroPath Blog | ZeroPath

A missing authorization vulnerability in Spring Boot 4.0 default security auto-configuration that can leave Actuator endpoints unauthenticated under a specific dependency combination, exposing sensitive data such as environment secrets, heap dumps, and configuration properties.

springNews

Apr 23, 2026

Spring Boot 4.0.6 available now

A Spring Boot security vulnerability where the default security filter chain lacks an authorization rule when Actuator is present without Health.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity11