En bref
- CVE-2026-40976 est une vulnérabilité CRITIQUE (CVSS 9.1) touchant org.springframework.boot:spring-boot, spring boot (vmware).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.49%, plus élevée que 42.1% des vulnérabilités.
- Correctif : mettre à jour vers 4.0.6 ou plus récent.
Description
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.
Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
NVD description
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.
Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Autres vulnérabilités de org.springframework.boot:spring-boot
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free