CVE-2026-40976

A critical security vulnerability, CVE-2026-40976, has been identified in Spring Boot versions 4.0.0 through 4.0.5. This flaw occurs when the default web security configuration fails to enforce authorization, which can allow unauthorized access to all application endpoints in certain servlet-based deployments. In vulnerable applications, exploitation is possible when the app is servlet-based, relies on the default Spring Security filter chain, depends on spring-boot-actuator-autoconfigure, and does not depend on spring-boot-health. Two related Spring Boot flaws have also been disclosed: CVE-2026-40973, which may let a local attacker hijack sessions or potentially execute code by taking control of the ApplicationTemp directory, and CVE-2026-40972, which may let an attacker on the same network use a timing attack against the DevTools remote secret and, in extreme cases, achieve remote code execution.

EPSS 0.02% · 6.8th percentile