CVE-2026-22733CWE-288

Authentication Bypass under Actuator CloudFoundry endpoints

High · published March 19, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
29.3
In the wild
Unconfirmed
What it is

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00366 · 29.3th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-03-19T23:29Z
EPSS history
Timeline
  • 19 MAR 23:29Z
    Authentication Bypass under Actuator CloudFoundry endpoints
    cvelistv5