AIKIDO-2026-10582
spring-boot-actuator-autoconfigure is vulnerable to Authentication Bypass
95
Critical Risk
This Affects:
spring-boot-actuator-autoconfigureTL;DR
Affected versions of this package are vulnerable to improper access control because the default security filter chain may apply no authorization rule under specific dependency and configuration conditions. In affected servlet-based applications, this can allow unauthorized access to all endpoints.
Who does this affect?
You are affected if using a vulnerable version.
Background info
spring-boot-actuator-autoconfigure is vulnerable to Authentication Bypass in versions 4.0.0 - 4.0.5.
How to fix this
Upgrade the org.springframework.boot:spring-boot-actuator-autoconfigure library to the patch version.
Links
spring.io/security/cve-2026-40976access.redhat.com/security/cve/CVE-2026-40976bugzilla.redhat.com/show_bug.cgi?id=2463322security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40976.json
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.