CVE-2026-22747: VMware Spring Security user impersonation in SubjectX500PrincipalExtractor

CVE-2026-22747 · Severity: medium · CVSS 6.8 · Published 2026-04-22

Spring Security, a widely used framework for securing Java applications, contains a vulnerability in how it processes digital certificates. An attacker can use a specially crafted certificate with a malformed Common Name (CN) to trick the system into identifying them as a different user. This could allow an unauthorized person to impersonate legitimate users and gain access to sensitive data or administrative functions.

Technologies: org.springframework.security:spring-security-web (Maven), VMware Spring Security. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-22747 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22747 being exploited in the wild.
How severe is CVE-2026-22747?
Medium severity, with a CVSS score of 6.8, published 22 April 2026.
Which products and versions are affected?
org.springframework.security:spring-security-web (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.5; VMware Spring Security 7.0.0 through 7.0.4.
Is there a fix for CVE-2026-22747?
Yes. org.springframework.security:spring-security-web (Maven): upgrade to 7.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22747 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-22747?
Check whether you run org.springframework.security:spring-security-web (Maven) or VMware Spring Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.security:spring-security-web (Maven): upgrade to 7.0.5 or later
    # set org.springframework.security:spring-security-web to 7.0.5 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Spring Security's SubjectX500PrincipalExtractor component due to improper validation of X.509 certificate Common Name (CN) values. When processing a certificate with a specifically malformed CN, the extractor may return an incorrect username, leading to authentication bypass via user impersonation. The attack requires the ability to present a crafted certificate to the application, typically in environments using X.509-based authentication. This issue affects versions 7.0.0 through 7.0.4 and is addressed in version 7.0.5. CVSS scores vary between 6.8 (Medium) and 8.1 (High) depending on the assumed attack complexity.

Affected products

  • VMware Spring Security 7.0.0 through 7.0.4

Identifiers

  • CVE-2026-22747
  • GHSA-2jrg-rf5x-568g

Timeline

  • 2026-04-22: disclosed: Initial vulnerability report and publication
  • 2026-04-22: advisory: Vendor advisory published by VMware/Spring

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.