# CVE-2026-40976: Spring Boot authentication bypass in default web security filter chain

Source: https://junglewise.ai/threats/cve-2026-40976-spring-boot-authentication-bypass-in-default-web-security-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-40976 · Severity: critical · CVSS 9.1 · Published 2026-04-28

A vulnerability in Spring Boot, a widely used framework for building Java applications, can cause default security protections to fail. In specific configurations, this allows unauthorized users to access all parts of the application without a password. This could lead to the exposure of sensitive data or unauthorized changes to the system.

Technologies: [org.springframework.boot:spring-boot (Maven)](https://junglewise.ai/threats/technologies/org-springframework-boot-spring-boot), [VMware Spring Boot](https://junglewise.ai/threats/technologies/spring-boot). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-40976 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40976 being exploited in the wild.

**How severe is CVE-2026-40976?** Critical severity, with a CVSS score of 9.1, published 28 April 2026.

**Which products and versions are affected?** org.springframework.boot:spring-boot (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.6.

**Is there a fix for CVE-2026-40976?** Yes. org.springframework.boot:spring-boot (Maven): upgrade to 4.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40976 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40976?** Check whether you run org.springframework.boot:spring-boot (Maven) or VMware Spring Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.boot:spring-boot (Maven): upgrade to 4.0.6 or later

  ```sh
  # set org.springframework.boot:spring-boot to 4.0.6 in your pom.xml or build.gradle
  ```


## Technical details

An authentication bypass vulnerability exists in Spring Boot when using default web security configurations. The issue occurs in servlet-based web applications that rely solely on the default Spring Security filter chain, include the 'spring-boot-actuator-autoconfigure' dependency, and lack the 'spring-boot-health' dependency. Under these conditions, the default security constraints are not correctly applied, granting unauthenticated network attackers full access to all application endpoints. The vulnerability is addressed in Spring Boot version 4.0.6.

## Affected products

- Spring Spring Boot 4.0.0–4.0.5
- Red Hat Red Hat Data Grid 8 8

## Identifiers

- CVE-2026-40976
- GHSA-8v8j-3hxp-93wr

## Timeline

- 2026-04-28: disclosed
- 2026-04-28: advisory

## References

- [https://spring.io/security/cve-2026-40976](https://spring.io/security/cve-2026-40976)
- [https://access.redhat.com/security/cve/CVE-2026-40976](https://access.redhat.com/security/cve/CVE-2026-40976)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2463322](https://bugzilla.redhat.com/show_bug.cgi?id=2463322)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40976.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40976.json)

## Related threats

- [VMware Spring Boot insecure directory in ArtemisEmbeddedConfigurationFactory](https://junglewise.ai/threats/cve-2026-41001-vmware-spring-boot-insecure-directory-in)
- [VMware Spring Boot improper certificate validation in Mail auto-configuration](https://junglewise.ai/threats/cve-2026-40992-vmware-spring-boot-improper-certificate-validation-in-mail-auto)
- [VMware Spring Boot link resolution vulnerability in ApplicationPidFileWriter](https://junglewise.ai/threats/cve-2026-40977-vmware-spring-boot-link-resolution-vulnerability-in)
- [Spring Boot weak PRNG in random value property source](https://junglewise.ai/threats/cve-2026-40975-spring-boot-weak-prng-in-random-value-property-source)
- [VMware Spring Boot Improper Certificate Validation in Cassandra auto-configuration](https://junglewise.ai/threats/cve-2026-40974-vmware-spring-boot-improper-certificate-validation-in-cassandra)