What is the CVSS score of CVE-2026-40976?

CVE-2026-40976 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring Boot are affected by CVE-2026-40976?

Spring Boot versions 4.0.0 through 4.0.5 contain a critical authentication bypass vulnerability that allows unauthenticated remote attackers to access all application endpoints, completely…. A patch is available.

How to fix or mitigate CVE-2026-40976?

24 hours: Identify all Spring Boot applications running versions 4.0.0-4.0.5 with spring-boot-actuator-autoconfigure enabled; prepare upgrade to Spring Boot 4.0.6 or later and test in non-production. 7 days: Deploy Spring Boot 4.0.6+ patches to all production systems; prioritize applications handling sensitive data or exposed to untrusted networks. 30 days: Complete full inventory validation; audit access logs for versions 4.0.0-4.0.5 during vulnerability window for evidence of exploitation.

Spring Boot CVE-2026-40976

CRITICAL

Missing Authorization (CWE-862)

2026-04-28 security@vmware.com

GHSA-8v8j-3hxp-93wr

Java Authentication Bypass Spring Boot

9.1

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Red Hat

9.1 HIGH

qualitative

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:23 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 00:31 vuln.today

Analysis Generated

Apr 28, 2026 - 00:22 vuln.today

CVE Published

Apr 28, 2026 - 00:16 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1,921 maven packages depend on org.springframework.boot:spring-boot (120 direct, 1,801 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.

Affected: Spring Boot 4.0.0-4.0.5; upgrade to 4.0.6 or later per vendor advisory.

AnalysisAI

Authentication bypass in Spring Boot 4.0.0-4.0.5 allows remote unauthenticated attackers to access all application endpoints, bypassing default web security filters entirely. Affects servlet-based applications using spring-boot-actuator-autoconfigure without custom Spring Security configuration and without spring-boot-health dependency. Vendor patch released (upgrade to 4.0.6+). No public exploit code identified at time of analysis, but CVSS 9.1 with network attack vector (AV:N/AC:L/PR:N) indicates trivial exploitation once configuration prerequisites are met.

Technical ContextAI

This vulnerability affects Spring Boot's autoconfiguration mechanism for web security in servlet-based applications. The issue stems from CWE-862 (Missing Authorization), where the framework fails to properly initialize the default web security filter chain under specific dependency conditions. The vulnerability occurs when spring-boot-actuator-autoconfigure is present but spring-boot-health is absent, creating a gap in the security filter registration logic. Spring Boot's convention-over-configuration design normally applies sensible security defaults for web applications, but this combination of dependencies causes the default SecurityFilterChain to fail initialization, leaving endpoints completely unprotected. The servlet container processes requests without any authorization checks, granting unrestricted access to application resources including actuator endpoints that may expose sensitive operational data.

RemediationAI

Upgrade to Spring Boot 4.0.6 or later as confirmed by VMware/Spring vendor advisory at https://spring.io/security/cve-2026-40976. For applications unable to upgrade immediately, implement one of these compensating controls: (1) Add explicit Spring Security configuration with SecurityFilterChain bean definition to override vulnerable defaults - this restores authorization checks but requires development effort and testing; (2) Add spring-boot-health dependency to the project, which prevents the vulnerable autoconfiguration path - minimal code change but increases application footprint and may expose health endpoints; (3) Remove spring-boot-actuator-autoconfigure dependency if actuator features are not required - eliminates attack surface but loses operational monitoring capabilities. All workarounds require application redeployment. Verify effectiveness by testing unauthenticated access to protected endpoints post-mitigation.