Security Bulletin: Maximo AI Service uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary Maximo AI Service uses nltk-3.9.1-py3-none-any.whl, mlflow-3.1.0-py3-none-any.whl, and spring-security-web-6.5.7.jar, which are vulnerable to CVE-2025-14009, CVE-2026-2635, CVE-2026-0848, and CVE-2026-22732. This bulletin contains information regarding how to address the vulnerabilities...

CVE-2026-22748

A flaw was found in Spring Security. When an application is configured to decode JSON Web Tokens JWTs using NimbusJwtDecoder or NimbusReactiveJwtDecoder, it may not properly validate these tokens if an OAuth2TokenValidator is not explicitly configured. This oversight could allow an attacker with...

CVE-2026-22753

A flaw was found in Spring Security. When an application uses specific configurations involving securityMatchersString and PathPatternRequestMatcher.Builder to handle servlet paths, the intended security controls may not be applied. This can result in a security bypass, where authentication and...

CVE-2026-22746

A flaw was found in Spring Security. If an application uses the UserDetailsisEnabled, isAccountNonExpired, or isAccountNonLocked user attributes, an attacker can bypass the DaoAuthenticationProvider's timing attack defense. This bypass allows an attacker to potentially gain limited information...

CVE-2026-22751

A flaw was found in Spring Security, specifically in applications configured for One-Time Token login using JdbcOneTimeTokenService. This vulnerability is due to a Time-of-check Time-of-use TOCTOU race condition. A remote attacker with high attack complexity could exploit this flaw to achieve low...

Spring Security Privilege Escalation

The vulnerability of the Java framework for securing industrial applications using Spring Security involves bypassing authentication through phising techniques. Exploiting this vulnerability can allow attackers, operating remotely, to increase their privileges...

Insufficient Verification of Data Authenticity

Overview org.springframework.security:spring-security-oauth2-jose is a provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the withIssuerLocation component. An attacker can bypass intended...

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +1336 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.0.0, <=6.5.9)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.0.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =0.5.2, =0.5.0, =7.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.10.0, =4.27.0 and more Source cves: CVE-2026-22748 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKSECURITY-16121448...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +6263 more potentially affected by CVE-2026-22746 via org.springframework.security:spring-security-core (>=6.0.0, <=6.5.9)

org.springframework.security:spring-security-core MAVEN version =6.0.0, =cloud-0.1, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =0.8.4 - ai.mindconnect:mc-agent-starter-namespace 0.8.4 - ai.yda-framework:channel-shared 0.1.0 - ai.yda-framework:rest-spring-channel 0.1.0 -...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +1129 more potentially affected by CVE-2026-22746 via org.springframework.security:spring-security-core (>=7.0.0-m1, <=7.0.4)

org.springframework.security:spring-security-core MAVEN version =7.0.0-m1, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

Information Exposure

Overview org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Information Exposure in the DaoAuthenticationProvider component. An attacker can determine the status of user...

Access Control Bypass

Overview org.springframework.security:spring-security-config is a security configuration package for Spring Framework. Affected versions of this package are vulnerable to Access Control Bypass in the XML authorization rules processing when the servlet-path attribute is used. An attacker can gain...

Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules

Vulnerability in Spring Spring Security. If an application uses to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass. This issue affects Spring Security: from...

EUVD-2026-24611

Vulnerability in Spring Spring Security. If an application is using securityMatchersString and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the...

GHSA-4VRC-J85C-598C Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules

Vulnerability in Spring Spring Security. If an application uses to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass. This issue affects Spring Security: from...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +863 more potentially affected by CVE-2026-22753 via org.springframework.security:spring-security-config (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-config MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

au.csiro.pathling:fhir-server (7.2.0), best.skn:skn-spring-security (>=1.3.0, <=1.5.0) +476 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.3.0, <=6.3.10)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.3.0, =1.3.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.1 and more Source cves: CVE-2026-22748 Source advisory: GHSA-CVC6-Q2CP-2X...

ch.admin.bit.jeap:jeap-archrepo-instance (>=1.10.0, <=1.23.0), ch.admin.bit.jeap:jeap-archrepo-test (>=1.10.0, <=1.23.0) +480 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.4.0, <=6.4.13)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.4.0, =1.10.0, =1.10.0, =1.10.0, =1.55.1, =1.55.1, =3.1.0, =3.1.0, =8.4.0, =1.0.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.38.0 and more Source cves: CVE-2026-22748 Source advisory: OSV...

au.csiro.pathling:fhir-server (7.2.0), best.skn:skn-spring-security (>=1.3.0, <=1.5.0) +476 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.3.0, <=6.3.10)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.3.0, =1.3.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.1 and more Source cves: CVE-2026-22748 Source advisory:...

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +766 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.5.0, <=6.5.9)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.5.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =0.1.0, =0.1.0, =0.1.0, =1.24.0, =1.24.0, =1.24.0, =1.0.0, =1.0.0, =2.2.0 and more Source cves: CVE-2026-22748 Source advisory: OSV:GHSA-CVC6-Q2CP-2XHW...