Which versions of Coverity Connect are affected by CVE-2026-8338?

Synopsys Black Duck Coverity Connect (versions 2023.6.0-2026.3.0) contains a critical authentication bypass vulnerability enabling unauthenticated attackers to access protected APIs and retrieve…. A patch is available.

How to fix or mitigate CVE-2026-8338?

Within 24 hours: Identify all Coverity Connect deployments and document version numbers; disable external network access to affected instances where operationally feasible; enable comprehensive API request logging. Within 7 days: Implement network-layer access controls restricting Coverity Connect to internal trusted hosts only via firewall or VPN; deploy a reverse proxy or API gateway to enforce additional authentication as a compensating control; review access logs for unauthorized API access attempts. Within 30 days: Monitor Synopsys security advisories for patch availability; plan and execute upgrades to patched versions once available; engage Synopsys support for interim guidance or emergency hotfixes.

Coverity Connect CVE-2026-8338

Q: What is the CVSS score of CVE-2026-8338?

CVE-2026-8338 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-50413 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-07-29 disclosure@synopsys.com

GHSA-f3gv-992v-c3v5

Authentication Bypass Java

9.2

CVSS 4.0 · Vendor: synopsys

Severity by source

Vendor (synopsys) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Remote and unauthenticated (AV:N/PR:N/UI:N) but a specific precondition and request-shaping are needed so AC:H; high confidentiality and integrity data access with minor availability impact and no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (synopsys).

CVSS VectorVendor: synopsys

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 29, 2026 - 18:17 EUVD

Analysis Generated

Jul 29, 2026 - 17:32 vuln.today

CVE Published

Jul 29, 2026 - 17:16 cve.org

CRITICAL 9.2

DescriptionCVE.org

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity.

Articles & Coverage 1

News Critical Authentication Bypass in Synopsys Coverity Connect - CVE-2026-8338 Jul 30, 2026

AnalysisAI

Authentication and authorization bypass in Synopsys/Black Duck Coverity Connect (versions 2023.6.0 through 2026.3.0) allows an unauthenticated attacker to reach certain protected API endpoints by sending a specially crafted HTTP request, exposing data held within Coverity. The flaw stems from a Spring Security misconfiguration classified as CWE-288 (authentication bypass using an alternate path or channel). It carries a CVSS 4.0 score of 9.2 (Critical); no public exploit has been identified at time of analysis, and the AC:H/AT:P metrics indicate exploitation is non-trivial despite requiring no authentication.

Technical ContextAI

Coverity Connect is the web/reporting server component of the Coverity static application security testing (SAST) platform, a Java application built on the Spring framework and using Spring Security for access control. The vulnerability is a Spring Security authentication/authorization bypass (CWE-288: Authentication Bypass Using an Alternate Path or Channel), which typically arises when URL/path matching in the security filter chain does not canonically match the servlet's routing - allowing crafted request paths (e.g., encoding tricks, path-parameter or matrix-variable manipulation, trailing characters, or case differences) to slip past the security interceptor while still reaching a protected controller. The result is that requests to 'certain API endpoints' are served without the authentication and authorization checks that normally gate them, disclosing and potentially manipulating Coverity project and analysis data.

RemediationAI

Upgrade Coverity Connect to a fixed release beyond the affected 2023.6.0-2026.3.0 range; consult the Black Duck Product Security Advisory (https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2026-8338-Authentication-and-Authorization-Bypass) for the exact patched version, as no specific fix version was included in the provided data and it should not be invented. As compensating controls until patched, restrict network reachability of the Coverity Connect web interface to trusted management networks or a VPN rather than exposing it to the internet, and place it behind a reverse proxy or WAF that normalizes and canonicalizes request paths and rejects ambiguous URL encodings, path parameters, and matrix variables commonly used to defeat Spring Security path matching - noting that overly strict normalization can break legitimate API clients and should be tested first. Additionally monitor Coverity API access logs for anonymous or unexpected requests to protected endpoints. These controls reduce exposure but do not eliminate the flaw; patching is the only complete fix.