CVE-2026-22731: 
Java vulnerability analysis and mitigation

CVE-2026-22731 is an authentication bypass vulnerability in Spring Boot applications that use the Actuator component, classified as HIGH severity. It occurs when an application endpoint requiring authentication is declared under a path already configured as a Health Group additional path, allowing unauthenticated network access to protected endpoints. The vulnerability affects Spring Boot versions 4.0.0–4.0.3, 3.5.0–3.5.11, and 3.4.0–3.4.14. It was publicly disclosed on March 19, 2026, and is related to but distinct from CVE-2026-22733. The CVSS v3.1 base score is 8.1 (High) per NVD, with an alternative scoring of 8.2 (High) noted by ENISA (Spring Advisory, Red Hat Bugzilla).

The root cause is a path-based authentication misconfiguration (CWE-288: Authentication Bypass Using an Alternate Path or Channel; CWE-305: Authentication Bypass by Primary Weakness; CWE-306: Missing Authentication for Critical Function). Exploitation requires a specific confluence of conditions: the Actuator dependency must be on the classpath, a custom health group must be defined (e.g., management.endpoint.health.group.mygroup.include), that group must be exposed via an additional path on the main server (e.g., management.endpoint.health.group.mygroup.additional-path=server:/healthz), and an application endpoint requiring authentication must be mapped under a subpath of that health group path (e.g., /healthz/admin). When these conditions are met, Spring Boot's path matching logic allows unauthenticated requests to reach the protected endpoint via the health group path. The Spring team notes that mapping application endpoints under Actuator infrastructure endpoints is not a recommended practice and is likely to cause configuration conflicts (Spring Advisory).

Successful exploitation allows unauthenticated remote attackers to bypass authentication controls and access protected application endpoints exposed through the Spring Boot Actuator. The impact spans confidentiality (access to sensitive configuration data, application state, and system information), integrity (potential unauthorized modification of application behavior via exposed endpoints), and availability (high impact per CVSS scoring). Actuator endpoints can expose sensitive operational data including environment variables, heap dumps, thread dumps, and application metrics, making unauthorized access particularly damaging (Spring Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.041%, reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific and uncommon application configuration, which the Spring team notes is unlikely to occur in production environments, limiting the practical attack surface despite the high CVSS score (Spring Advisory).

1. Reconnaissance: Identify Spring Boot applications with Actuator enabled that are internet-facing or accessible on the network, using tools like Shodan, Censys, or manual probing for common Actuator endpoints (e.g., /actuator/health).
2. Identify Health Group additional paths: Probe for custom health group paths configured as additional paths on the main server (e.g., /healthz, /health/live) by testing common health check endpoint patterns.
3. Enumerate subpaths: Attempt to discover application endpoints mapped under the identified health group path (e.g., /healthz/admin, /healthz/metrics) that would normally require authentication.
4. Send unauthenticated request: Issue an HTTP GET or POST request directly to the protected subpath (e.g., GET /healthz/admin) without any authentication credentials or tokens.
5. Access protected endpoint: If the application is vulnerable, Spring Boot's path matching logic will route the request through the health group path configuration, bypassing the authentication requirement and returning a successful response with protected data or functionality (Spring Advisory).

• Network: Unauthenticated HTTP requests to application subpaths that overlap with configured Actuator Health Group additional paths (e.g., GET /healthz/admin without Authorization headers); unusual access patterns to Actuator-adjacent paths from external IP addresses.
• Logs: Application access logs showing successful (HTTP 200) responses to protected endpoint paths without authentication tokens or session cookies; repeated probing of health-group-configured paths with varying subpaths.
• Application Behavior: Unexpected access to sensitive Actuator data (environment variables, heap dumps, configuration) without corresponding authenticated sessions in application audit logs.

Users should upgrade to the fixed versions: Spring Boot 4.0.4, 3.5.12, or 3.4.15. No additional mitigation steps are required beyond upgrading. As a configuration-level workaround prior to patching, avoid mapping application endpoints that require authentication under paths already configured as Health Group additional paths. Additionally, implementing network-level access controls (e.g., firewall rules, API gateway policies) to restrict access to Actuator endpoints to trusted networks is a recommended defense-in-depth measure. Red Hat has addressed this issue via RHSA-2026:17668 for Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 (Spring Advisory, Red Hat Bugzilla).

The Spring team published the advisory on March 19, 2026, noting that while the severity is rated High, the specific configuration required makes this vulnerability unlikely to occur in production environments. HeroDevs published a blog post covering both CVE-2026-22731 and the related CVE-2026-22733, framing them as vulnerabilities enterprise teams cannot afford to ignore. Heise reported on the broader set of Spring product vulnerabilities disclosed around the same time. The Canadian Centre for Cyber Security (CCCS) issued a security advisory (AV26-259) covering this vulnerability. Community discussion on Mastodon and LinkedIn noted the niche exploitation conditions but highlighted the importance of patching given the high CVSS score (HeroDevs Blog, Heise, CCCS).