CVE-2026-22733: 
Wolfi vulnerability analysis and mitigation

CVE-2026-22733 is an Authentication Bypass vulnerability in Spring Boot applications that use the Actuator and Spring Security dependencies together. It occurs when an application endpoint requiring authentication is declared under the path used by CloudFoundry Actuator endpoints (e.g., /cloudfoundryapplication/admin), allowing unauthenticated access to those protected endpoints. The vulnerability was disclosed on March 19, 2026, and affects Spring Boot versions 4.0.0–4.0.3, 3.5.0–3.5.11, 3.4.0–3.4.14, 3.3.0–3.3.17, and 2.7.0–2.7.31; older unsupported versions are also vulnerable. It carries a CVSS v3.1 base score of 8.1 (High) per NVD, and 8.2 (High) per ENISA EUVD (Spring Advisory, ENISA EUVD).

The root cause is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Spring Boot's CloudFoundry Actuator integration exposes endpoints under /cloudfoundryapplication; when an application developer maps a custom, authentication-required endpoint as a subpath of this infrastructure path (e.g., /cloudfoundryapplication/admin), the CloudFoundry security filter chain may bypass the application's own authentication requirements for that path. Exploitation requires four conditions to be simultaneously true: the application must be a web application, have the Actuator dependency on the classpath, have Spring Security on the classpath, and expose an authenticated endpoint under the CloudFoundry Actuator subpath. The Spring team notes that mapping application endpoints under infrastructure endpoints is not recommended and is expected to be rare in production (Spring Advisory). This CVE is related to but distinct from CVE-2026-22731, which has different exploit conditions and affected versions (Spring Advisory).

Successful exploitation allows unauthenticated remote attackers to access application endpoints that are intended to be protected by authentication, potentially exposing sensitive functionality and data. The CVSS assessment reflects high confidentiality, integrity, and availability impact, though the attack complexity is rated High due to the specific configuration preconditions required. Depending on what the bypassed endpoint exposes, attackers could read sensitive data, trigger privileged operations, or manipulate application state without valid credentials (Spring Advisory, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). No threat actor attribution has been identified. The EPSS score is approximately 0.041% (0.000410), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity rating reflects the specific and uncommon configuration required for exploitation, which the Spring team expects to rarely occur in production (Spring Advisory).

1. Reconnaissance: Identify Spring Boot applications that use both the Actuator and Spring Security dependencies and are deployed in a CloudFoundry environment or have CloudFoundry Actuator support enabled.
2. Identify vulnerable endpoint: Determine if the target application exposes any custom endpoint under the /cloudfoundryapplication/ path hierarchy (e.g., /cloudfoundryapplication/admin) that normally requires authentication.
3. Send unauthenticated request: Issue an HTTP request directly to the identified subpath (e.g., GET /cloudfoundryapplication/admin) without providing authentication credentials or tokens.
4. Bypass authentication: Due to the CloudFoundry Actuator security filter chain taking precedence over the application's own security configuration for that path, the request is processed without triggering the application's authentication requirement.
5. Access protected functionality: Receive a successful response from the protected endpoint, gaining access to sensitive data or privileged operations exposed by that endpoint (Spring Advisory).

• Network: Unexpected unauthenticated HTTP requests to paths beginning with /cloudfoundryapplication/ followed by application-specific subpaths (e.g., /cloudfoundryapplication/admin); successful HTTP 200 responses to such requests without Authorization headers.
• Logs: Application access logs showing requests to /cloudfoundryapplication/* subpaths returning 200 OK without authentication tokens or session cookies; absence of authentication-related log entries (e.g., login events) preceding access to sensitive endpoints.
• Application Behavior: Unexpected access to sensitive data or privileged operations that should require authentication, particularly from unknown or external IP addresses.

The Spring team has released patched versions that resolve this vulnerability; users should upgrade to the corresponding fixed release: 4.0.4 (for 4.0.x), 3.5.12 (for 3.5.x), 3.4.15 (for 3.4.x), 3.3.18 (for 3.3.x), or 2.7.32 (for 2.7.x). No additional mitigation steps are required beyond upgrading. As an interim measure if patching is not immediately possible, organizations should avoid mapping application endpoints under the /cloudfoundryapplication/ path, restrict network access to Actuator endpoints, and review CloudFoundry Actuator configurations to ensure proper authentication controls are in place (Spring Advisory, IBM Advisory).

The Canadian Centre for Cyber Security (CCCS) issued a security advisory (AV26-259) covering this vulnerability shortly after disclosure (CCCS Advisory). HeroDevs published a blog post covering CVE-2026-22733 alongside the related CVE-2026-22731, characterizing them as vulnerabilities enterprise teams cannot afford to ignore (HeroDevs Blog). Security news outlet SecurityOnline.info also covered the authentication bypass flaws in Spring Boot Actuator. IBM issued multiple security bulletins for affected products including IBM DevOps Solution Workbench, IBM Observability with Instana (OnPrem), and IBM Library Support for Spring (IBM Advisory). The Spring team credited responsible disclosure to researcher Gyu-hyeok Lee (g2h) (Spring Advisory).