CVE-2026-22753: 
Wolfi vulnerability analysis and mitigation

CVE-2026-22753 is a security control bypass vulnerability in VMware/Broadcom Spring Security, titled "Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers." When an application uses securityMatchers(String) together with a PathPatternRequestMatcher.Builder bean to prepend a servlet path, the filter chain matching logic may fail, causing authentication, authorization, and other security controls to be rendered inactive on intended requests. The vulnerability affects Spring Security versions 7.0.0 through 7.0.4; Spring Security 6.x and earlier are not affected. It was disclosed on April 20–22, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Spring Advisory, Github Advisory).

The root cause is classified as CWE-693 (Protection Mechanism Failure): Spring Security 7's integration between string-based matchers (securityMatchers(String)) and a published PathPatternRequestMatcher.Builder bean fails to correctly incorporate the servlet path during request matching. As a result, requests that should be matched to a secured filter chain are not matched, and the associated security components — including authentication and authorization filters — are never invoked. The flaw is only triggered when both conditions are present: the application uses securityMatchers(String) and a PathPatternRequestMatcher.Builder bean is configured to prepend a servlet path (e.g., via the Spring Boot property spring.mvc.servlet.path). No public proof-of-concept exploit code has been identified (Spring Advisory, Github Advisory).

Successful exploitation allows unauthenticated, network-accessible attackers to bypass authentication and authorization controls on endpoints that application developers intended to protect, resulting in unauthorized access to protected resources. The primary impact is on integrity (CVSS Integrity: High), as attackers can interact with or modify resources without proper authorization. Confidentiality and availability are not directly impacted by the vulnerability itself, though unauthorized access to protected endpoints may expose sensitive data or functionality depending on the application (Spring Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.047–0.063%, placing it in the 20th percentile for exploitation likelihood within 30 days. No threat actor attribution has been reported. The attack requires no privileges or user interaction and is reachable over the network, but exploitation is limited to applications using the specific combination of securityMatchers(String) and a PathPatternRequestMatcher.Builder bean (Spring Advisory).

1. Reconnaissance: Identify web applications built on Spring Security 7.0.0–7.0.4 that expose HTTP endpoints, particularly those using Spring Boot with the spring.mvc.servlet.path property set (e.g., /api or /mvc).
2. Identify protected endpoints: Map the application's API surface to find endpoints that should require authentication or authorization (e.g., admin panels, user data endpoints under the configured servlet path).
3. Craft requests targeting the servlet path: Send HTTP requests directly to the protected endpoints using the servlet path prefix (e.g., GET /api/admin/users). Due to the path matching failure, the security filter chain is not invoked.
4. Bypass security controls: Because the securityMatchers(String) logic fails to match the request to the secured filter chain, authentication and authorization checks are skipped, granting unauthorized access to the protected resource.
5. Achieve objective: Access, exfiltrate, or manipulate data/functionality that should have been restricted, depending on the application's business logic (Spring Advisory, Github Advisory).

• Logs: Access logs showing successful HTTP responses (200, 201, etc.) to endpoints under the configured servlet path (e.g., /api/admin/**) from unauthenticated or unexpected clients; absence of Spring Security authentication/authorization log entries for requests that should have triggered them.
• Network: Unusual or repeated requests to protected API paths from unknown or external IP addresses without accompanying authentication headers (e.g., no Authorization or session cookie).
• Application Behavior: Unexpected data modifications, resource access, or administrative actions occurring without corresponding authenticated user sessions in application audit logs.

Users should upgrade Spring Security to version 7.0.5 (OSS), which resolves the path matching flaw (Spring Advisory, Github Advisory). For those unable to upgrade immediately, the recommended workaround is to include the servlet path directly in the matcher pattern rather than relying on the PathPatternRequestMatcher.Builder bean:

http.securityMatchers("/servlet-path/admin/**") // ...

Applications not using securityMatchers(String) or not configuring a servlet path via PathPatternRequestMatcher.Builder are not affected and do not require action. After patching, review and test security matcher configurations to confirm proper request matching and security control enforcement.

Heise (a German technology news outlet) covered the vulnerability, noting that attackers could log in as malicious clients due to the Spring Security flaw (Heise). HeroDevs published a blog post covering this CVE as part of a broader analysis of Spring Security's April 2026 advisories, which included two critical authorization bypasses (HeroDevs Blog). The vulnerability was also noted on social platforms including Bluesky and LinkedIn, with general community awareness but no significant controversy or debate. F5 published a support article (K000161272) indicating potential impact on their products (F5 Advisory).