CVE-2026-8338
CriticalCVSS 9.2Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Coverity Connect versions between 2023.6.0 and 2026.3.0 have a Spring Security authentication and authorization bypass vulnerability. An unauthenticated attacker can send a crafted HTTP request to access data within Coverity.
Risk Assessment
An attacker can gain unauthorized access to sensitive data stored in Coverity, compromising confidentiality and integrity.
Recommendation
Update Coverity Connect to a version later than 2026.3.0 that includes the security fix.
Original NVD description (English source)
A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity.