CVE-2026-40976
Critical · CVSS 9.1Spring Boot — Missing Authorization / Authentication Bypass allowing unauthorized access to all endpoints
- CVSS
- 9.1
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-862, CWE-305
Description
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Search profile — drives PoC discovery
Symbols spring-boot-actuator-autoconfigurespring-boot-healthdefault web security filter chainWebSecurityFilterChainSecurityFilterChainactuatorservlet-based web applicationSpringBootWebSecurityConfigurationdefaultSecurityFilterChain
Keywords CVE-2026-40976Spring Bootauthentication bypassmissing authorizationactuator autoconfiguredefault web securityunauthorized accessSpring Security misconfigurationSpring Boot 4.0CWE-862CWE-305security filter chain bypassSpring Boot actuator unauthenticated
Versions: 4.0.0–4.0.5
Affected packages
| Maven | org.springframework.boot:spring-boot | 4.0.0 → 4.0.6 |
References
Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T12:30:14.000Z