Executive brief
A vulnerability in Spring Boot, a widely used framework for building Java applications, can cause default security protections to fail. In specific configurations, this allows unauthorized users to access all parts of the application without a password. This could lead to the exposure of sensitive data or unauthorized changes to the system.
Technical details
An authentication bypass vulnerability exists in Spring Boot when using default web security configurations. The issue occurs in servlet-based web applications that rely solely on the default Spring Security filter chain, include the 'spring-boot-actuator-autoconfigure' dependency, and lack the 'spring-boot-health' dependency. Under these conditions, the default security constraints are not correctly applied, granting unauthenticated network attackers full access to all application endpoints. The vulnerability is addressed in Spring Boot version 4.0.6.
Affected products
- Spring Spring Boot 4.0.0–4.0.5
- Red Hat Red Hat Data Grid 8 8
Timeline
- 2026-04-28: disclosed
- 2026-04-28: advisory