What is the CVSS score of CVE-2026-22754?

CVE-2026-22754 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring Security are affected by CVE-2026-22754?

Spring Security versions 7.0.0 through 7.0.4 contain an authorization bypass vulnerability that allows unauthenticated attackers to access protected application endpoints by exploiting servlet-path…. A patch is available.

How to fix or mitigate CVE-2026-22754?

Within 24 hours: Inventory all applications using Spring Security 7.0.0-7.0.4 and verify servlet-path-based intercept-url configurations in security XML or Java configurations. Within 7 days: Immediately upgrade Spring Security to version 7.0.5 or later; coordinate with development teams to validate post-upgrade functionality. Within 30 days: Conduct access log audit for the past 90 days to identify any unauthorized endpoint access; deploy network segmentation or WAF rules to restrict access to protected endpoints if upgrade is temporarily delayed.

Spring Security CVE-2026-22754

EUVD-2026-24612 HIGH

Improper Access Control (CWE-284)

2026-04-22 vmware

GHSA-4vrc-j85c-598c

Authentication Bypass Java Spring Security

7.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 17:22 vuln.today

cvss_changed

Analysis Generated

Apr 22, 2026 - 06:30 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 06:00 euvd

EUVD-2026-24612

Analysis Generated

Apr 22, 2026 - 06:00 vuln.today

CVE Published

Apr 22, 2026 - 05:32 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

142 maven packages depend on org.springframework.security:spring-security-config (21 direct, 121 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionCVE.org

Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.

AnalysisAI

Authorization bypass in Spring Security 7.0.0-7.0.4 allows unauthenticated remote attackers to circumvent access controls when applications use servlet-path-based intercept-url configurations. The framework fails to include the servlet path when computing pattern matches for authorization rules, causing protected endpoints to become accessible without proper authorization checks. No public exploit code identified at time of analysis, but the straightforward bypass condition (misconfigured servlet-path directives) and network attack vector (CVSS AV:N/AC:L/PR:N) make this readily exploitable in affected deployments.

Technical ContextAI

Spring Security is a comprehensive authentication and authorization framework for Java applications. This vulnerability stems from incorrect path computation logic when developers use XML-based security configuration with the servlet-path attribute in <sec:intercept-url> elements. The framework is designed to evaluate authorization rules by matching request paths against configured patterns, but versions 7.0.0 through 7.0.4 contain a defect where the servlet path component is excluded from the matching algorithm. This causes the pattern matcher to evaluate only partial paths, bypassing rules intended to protect specific servlet endpoints. The vulnerability affects applications using servlet-path-based security configurations, a common pattern in Spring MVC applications with multiple servlet mappings. The CWE classification is not provided, but this represents an improper authorization check (CWE-863) or incorrect path traversal sanitization leading to security bypass.

RemediationAI

Upgrade Spring Security to version 7.0.5 or later, which contains the fix for incorrect servlet-path computation (exact patch version inferred from affected range 7.0.0-7.0.4; verify latest release at https://spring.io/security/cve-2026-22754). For environments unable to upgrade immediately, implement compensating controls by auditing all intercept-url configurations and replacing servlet-path-based patterns with explicit full-path patterns that include the servlet path prefix manually, though this requires careful testing to avoid introducing new authorization gaps. Alternatively, migrate affected authorization rules to Java-based configuration using HttpSecurity.authorizeHttpRequests() which does not exhibit this vulnerability, but note this requires code changes and regression testing. As a temporary defense-in-depth measure, deploy upstream authentication proxy or API gateway to enforce authorization independently of Spring Security, accepting the operational overhead of dual authorization layers. Review application logs for unauthorized access attempts to endpoints previously protected by servlet-path rules.