Spring Boot CVE-2026-40976

Vulnerable deployment requires ALL of the following: servlet-based web application architecture (not reactive/WebFlux); spring-boot-actuator-autoconfigure dependency present in the application; spring-boot-health dependency NOT present in the application; no custom Spring Security configuration defined (relying entirely on Spring Boot autoconfiguration). If the application implements any custom SecurityFilterChain bean, uses reactive/WebFlux stack instead of servlet, includes spring-boot-health dependency, or does not use actuator-autoconfigure, it is NOT vulnerable. Network accessibility to application endpoints is required for remote exploitation (AV:N), but no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L) mean any network-reachable instance meeting dependency conditions is trivially exploitable.

Real-world risk is HIGH but deployment-specific. CVSS 9.1 (Critical) accurately reflects the security impact when vulnerable configurations exist: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), and high confidentiality/integrity impact (C:H/I:H). However, exploitation requires a narrow dependency configuration - applications must use actuator-autoconfigure WITHOUT spring-boot-health AND have no custom Spring Security configuration. Many production Spring Boot applications implement custom security or include the full actuator suite (including health), which would NOT be vulnerable. EPSS data not provided but expected to be moderate given the specific prerequisites. No CISA KEV listing and no public exploit identified at time of analysis, suggesting no confirmed widespread exploitation. SSVC decision: exploitation status unknown, automatable once conditions met (AC:L), technical impact is total for affected deployments (full authentication bypass). Priority depends on internal configuration audit - organizations using affected dependency combinations should treat as CRITICAL and patch immediately; others can prioritize based on standard change management cycles after verifying non-vulnerable status.

Remote attacker identifies a Spring Boot 4.0.x application with actuator endpoints exposed (common in microservice architectures). Without authentication, the attacker sends HTTP requests directly to application endpoints that should be protected. Due to the missing security filter chain, all requests succeed without authorization checks. Attacker accesses sensitive actuator endpoints to enumerate configuration details, environment variables containing credentials, and application metrics. Using discovered credentials or internal API knowledge, attacker modifies application state through management endpoints or accesses business logic endpoints to exfiltrate data or manipulate records. No public exploit code identified at time of analysis, but exploitation is trivial once vulnerable configuration is confirmed (AC:L).