CVE-2026-40976
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Spring Boot versions 4.0.0–4.0.5 have ineffective default web security, allowing unauthorized access to all endpoints. The vulnerability affects servlet-based applications without custom Spring Security configuration, using spring-boot-actuator-autoconfigure and not depending on spring-boot-health.
Risk Assessment
Unauthenticated attackers can access sensitive endpoints, including actuator, leading to information disclosure or privilege escalation.
Recommendation
Upgrade Spring Boot to version 4.0.6 or later as per vendor advisory.
Other vulnerabilities in Spring Boot
See all- CVE-2026-41001Medium
Vulnerability in Spring Boot where ArtemisEmbeddedConfigurationFactory uses a fixed, predictable path for the Artemis broker data directory. A local attacker can create a symlink before application start.
- CVE-2026-40992Medium
In Spring Boot, a vulnerability was found in the mail auto-configuration that does not enable hostname verification. Applications that explicitly set the JavaMail property (e.g., spring.mail.properties.mail.smtp.ssl.checkserveridentity=true) are not affected. Affected versions are Spring Boot 4.0.0-4.0.6, 3.5.0-3.5.14, and 3.4.0-3.4.16.
- CVE-2026-40977Medium
In Spring Boot, when an application uses ApplicationPidFileWriter, a local attacker with write access to the PID file location can corrupt one file on the host each time the application starts. Affects versions 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, 2.7.0-2.7.32.
- CVE-2026-40975Medium
In Spring Boot, values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected, but ${random.int} and ${random.long} have a predictable range. Affected versions: 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, 2.7.0–2.7.32.
- CVE-2026-40974Medium
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. This affects multiple Spring Boot versions including 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, and 2.7.0–2.7.32.
- CVE-2026-40973High
Spring Boot versions 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, 2.7.0-2.7.32 have a vulnerability due to a predictable temp directory (ApplicationTemp). A local attacker can take control of this directory, and with persistent sessions enabled, can read sessions, hijack users, or execute code.
- CVE-2026-40972High
An attacker on the same network as the remote application may use a timing attack to leak information about the remote secret. In extreme cases, this could allow the attacker to determine the secret and upload modified classes, achieving remote code execution.
- CVE-2026-40971Medium
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected versions: Spring Boot 4.0.0–4.0.5 (fixed in 4.0.6), 3.5.0–3.5.13 (fixed in 3.5.14).
Original NVD description (English source)
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS