Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-40976: Spring Boot may let anyone access all web pages

CVE-2026-40976 · published 6 months ago

Summary

If your web app uses Spring Boot version 4.0.0‑4.0.5, relies on the default security settings, and includes the actuator auto‑configuration, attackers could reach any endpoint without permission. Upgrade to Spring Boot 4.0.6 or newer to restore proper access controls.

What to do

Update springframework org.springframework.boot:spring-boot to version 4.0.6.
Update root io.root.org.springframework.boot:spring-boot to version 4.0.5-root.io.2.
Update springframework org.springframework.boot:spring-boot to version 4.0.5-aikido.2.
Update root io.root.org.springframework.boot:spring-boot to version 4.0.6-root.io.1.
Update springframework org.springframework.boot:spring-boot to version 4.0.6-aikido.1.
Update org.springframework.boot:spring-boot to version 4.0.6-aikido.1.
Update io.root.org.springframework.boot:spring-boot to version 4.0.6-root.io.1.
Update vmware spring_boot to version 4.0.6 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	springframework	org.springframework.boot:spring-boot	>= 4.0.0, < 4.0.6 Fix: upgrade to 4.0.6
Root:Maven	root	io.root.org.springframework.boot:spring-boot	< 4.0.5-root.io.2 < 4.0.6-root.io.1 Fix: upgrade to 4.0.5-root.io.2
Root:Maven	springframework	org.springframework.boot:spring-boot	< 4.0.5-aikido.2 < 4.0.6-aikido.1 Fix: upgrade to 4.0.5-aikido.2
Root:Maven	–	org.springframework.boot:spring-boot	< 4.0.6-aikido.1 Fix: upgrade to 4.0.6-aikido.1
Root:Maven	–	io.root.org.springframework.boot:spring-boot	< 4.0.6-root.io.1 Fix: upgrade to 4.0.6-root.io.1
–	vmware	spring_boot	>= 4.0.0, < 4.0.6 `cpe:2.3:a:vmware:spring_boot::::::::`

Original advisory text

CVE-2026-40976 in org.springframework.boot:spring-boot - Patched by Root

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.

Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

References

https://github.com/advisories/GHSA-8v8j-3hxp-93wr
https://spring.io/security/cve-2026-40976 URL
https://nvd.nist.gov/vuln/detail/CVE-2026-40976 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40976... Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2463322 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40976.json URL
https://access.redhat.com/security/cve/CVE-2026-40976 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.1 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

CWE-305Authentication Bypass by Primary Weakness

Timeline

Published27 Apr 2026

Updated15 Nov 2026

First seen28 Apr 2026

Sources

CVE-2026-40976 · NVD

GHSA-8v8j-3hxp-93wr · GHSA

ROOT-APP-MAVEN-CVE-2026-40976 · OSV

CVE-2026-40976 · OSV

Track software like this

Free during beta