CVE-2026-40976
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Spring Boot versions 4.0.0–4.0.5 have ineffective default web security, allowing unauthorized access to all endpoints. The vulnerability affects servlet-based applications without custom Spring Security configuration, using spring-boot-actuator-autoconfigure and not depending on spring-boot-health.
Risk Assessment
Unauthenticated attackers can access sensitive endpoints, including actuator, leading to information disclosure or privilege escalation.
Recommendation
Upgrade Spring Boot to version 4.0.6 or later as per vendor advisory.
Original NVD description (English source)
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.