CVE-2026-40477: Thymeleaf security bypass in expression execution mechanisms

CVE-2026-40477 · Severity: critical · CVSS 9 · Published 2026-04-17

Thymeleaf, a widely used Java tool for generating web pages, contains a security flaw that could allow attackers to take control of a server. If an application using Thymeleaf accepts unvalidated user input, an attacker can bypass built-in security restrictions to execute unauthorized commands. This could lead to a total compromise of the server, including the theft of sensitive data or disruption of services.

Technologies: org.thymeleaf:thymeleaf (Maven), org.thymeleaf:thymeleaf-spring5 (Maven), org.thymeleaf:thymeleaf-spring6 (Maven), Red Hat Fuse 7, Red Hat Single Sign-On 7, Thymeleaf, Thymeleaf-Spring5, Thymeleaf-Spring6. Vendors: Maven, Red Hat, Thymeleaf.

Quick answers

Is CVE-2026-40477 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40477 being exploited in the wild.
How severe is CVE-2026-40477?
Critical severity, with a CVSS score of 9, published 17 April 2026.
Which products and versions are affected?
org.thymeleaf:thymeleaf (Maven) <= 3.1.3.RELEASE, ECOSYSTEM:introduced=0,fixed=3.1.4.RELEASE; org.thymeleaf:thymeleaf-spring5 (Maven) <= 3.1.3.RELEASE, ECOSYSTEM:introduced=0,fixed=3.1.4.RELEASE; org.thymeleaf:thymeleaf-spring6 (Maven) <= 3.1.3.RELEASE, ECOSYSTEM:introduced=0,fixed=3.1.4.RELEASE; Red Hat Fuse 7 7; and 4 more.
Is there a fix for CVE-2026-40477?
Yes. org.thymeleaf:thymeleaf (Maven): upgrade to 3.1.4.RELEASE or later; org.thymeleaf:thymeleaf-spring5 (Maven): upgrade to 3.1.4.RELEASE or later; org.thymeleaf:thymeleaf-spring6 (Maven): upgrade to 3.1.4.RELEASE or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40477 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40477?
Check whether you run org.thymeleaf:thymeleaf (Maven), org.thymeleaf:thymeleaf-spring5 (Maven), org.thymeleaf:thymeleaf-spring6 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.thymeleaf:thymeleaf (Maven): upgrade to 3.1.4.RELEASE or later
    # set org.thymeleaf:thymeleaf to 3.1.4.RELEASE in your pom.xml or build.gradle
  • org.thymeleaf:thymeleaf-spring5 (Maven): upgrade to 3.1.4.RELEASE or later
    # set org.thymeleaf:thymeleaf-spring5 to 3.1.4.RELEASE in your pom.xml or build.gradle
  • org.thymeleaf:thymeleaf-spring6 (Maven): upgrade to 3.1.4.RELEASE or later
    # set org.thymeleaf:thymeleaf-spring6 to 3.1.4.RELEASE in your pom.xml or build.gradle

Technical details

A Server-Side Template Injection (SSTI) vulnerability exists in Thymeleaf due to improper restriction of the scope of accessible objects within its expression execution mechanisms. While the library includes protections against expression injection, it fails to adequately restrict access to sensitive objects, which can be reached from within a template. An unauthenticated remote attacker can exploit this by providing malicious input to an application that passes unvalidated data directly to the template engine. This allows the attacker to bypass security restrictions and achieve arbitrary code execution on the server. The issue is tracked as CWE-917 and CWE-1336 and has been resolved in version 3.1.4.RELEASE.

Affected products

  • Thymeleaf Thymeleaf <= 3.1.3.RELEASE
  • Thymeleaf thymeleaf-spring5 <= 3.1.3.RELEASE
  • Thymeleaf thymeleaf-spring6 <= 3.1.3.RELEASE
  • Red Hat OpenShift Dev Spaces 3.28
  • Red Hat Fuse 7 7
  • Red Hat Single Sign-On 7 7

Identifiers

  • CVE-2026-40477
  • GHSA-r4v4-5mwr-2fwr

Timeline

  • 2026-04-15: advisory: GitHub Security Advisory published by Thymeleaf developers
  • 2026-04-17: disclosed: CVE published to NVD
  • 2026-05-28: patched: Red Hat released security advisory RHSA-2026:21772 for OpenShift Dev Spaces

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.