Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreCVE-2026-40976: Default security filter chain has no authorization rule with Actuator but without Health
Description
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must:
- be a servlet-based web application
- have no Spring Security configuration of its own and rely on the default web security filter chain
- depend on spring-boot-actuator-autoconfigure
- not depend on spring-boot-health
If any of the above does not apply, the application is not vulnerable.
Affected Spring Products and Versions
Spring Boot:
- 4.0.0 - 4.0.5
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 4.0.x | 4.0.6 | OSS |
No further mitigation steps are necessary.
References
History
- 2026-04-23: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all