K000163434: Spring Boot vulnerability CVE-2026-40976

Security Advisory Description In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on t...

CVE-2026-40976: Missing Authorization

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter...

ai.ancf.lmos:arc-runner (>=0.1.1, <=0.114.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +5019 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=3.0.0, <=3.5.11)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =3.0.0, =0.1.1, =0.0.4, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =cloud-0.1, =0.6 - ai.ylyue:yue-library-base j17.3.3.1 - ai.ylyue:yue-library-base-crypto j17.3.3.1 and more Source...

ai.ancf.lmos:arc-runner (>=0.1.1, <=0.114.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +4250 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=3.0.0, <=3.4.4)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =3.0.0, =0.1.1, =0.0.4, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =cloud-0.1, =0.6 - ai.ylyue:yue-library-base j17.3.3.1 - ai.ylyue:yue-library-base-crypto j17.3.3.1 and more Source...

ai.ancf.lmos:arc-runner (>=0.1.1, <=0.112.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.4.0) +5205 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=2.7.0, <=3.3.10)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =2.7.0, =0.1.1, =0.0.4, =0.1.0, =cloud-0.1, =6.4.0, =1.1.0, =2.3.0, =1.1.0, =1.1.0, =2.10.0, =1.1.0, =1.1.0, =2.3.0, =1.1.0, =1.2.0 and more Source cves: CVE-2025-22235 Sou...

Access Restriction Bypass

org.springframework.boot:spring-boot-actuator-autoconfigure is vulnerable to Access Restriction Bypass. The vulnerability is due to improper wild card matching, which allows a remote attacker to bypass access restrictions and gain access to the system. Please note that the vulnerability is only...