CVE-2026-22731CWE-288

Authentication Bypass under Actuator Health groups paths

High · published March 19, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
26.2
In the wild
Unconfirmed
What it is

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.

This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.

This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00340 · 26.2th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-03-19T22:36Z
EPSS history
Timeline
  • 19 MAR 22:36Z
    Authentication Bypass under Actuator Health groups paths
    cvelistv5