Vulnerability-Lookup

CVE-2026-40976 (GCVE-0-2026-40976)

Vulnerability from cvelistv5 – Published: 2026-04-27 23:34 – Updated: 2026-06-30 12:08

Summary

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization
CWE-305 - Authentication Bypass by Primary Weakness

Assigner

vmware

References

4 references

URL	Tags
https://spring.io/security/cve-2026-40976
https://access.redhat.com/security/cve/CVE-2026-40976	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2463322	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

16 products

Vendor	Product	Version
Spring	Spring Boot	Affected: 4.0.0 , < 4.0.6 (custom)
Red Hat	Red Hat Data Grid 8	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7
Red Hat	Red Hat AMQ Clients	cpe:/a:redhat:amq_clients:2023
Red Hat	Red Hat build of Apache Camel - HawtIO 4	cpe:/a:redhat:apache_camel_hawtio:4
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	cpe:/a:redhat:camel_spring_boot:4
Red Hat	Red Hat build of OptaPlanner 8	cpe:/a:redhat:optaplanner:::el6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat JBoss Enterprise Application Platform 8	cpe:/a:redhat:jboss_enterprise_application_platform:8
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat OpenShift Dev Spaces	cpe:/a:redhat:openshift_devspaces:3
Red Hat	Red Hat Process Automation 7	cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40976",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-28T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-29T03:55:41.205Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:amq_clients:2023"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat AMQ Clients",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:apache_camel_hawtio:4"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of Apache Camel - HawtIO 4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:camel_spring_boot:4"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of Apache Camel for Spring Boot 4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat JBoss Enterprise Application Platform 7",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat OpenShift Dev Spaces",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-27T23:34:51.422Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Spring Boot. Under specific conditions, including being a servlet-based web application without custom Spring Security configuration and relying on the default web security filter chain, a remote attacker could bypass security. This allows unauthorized access to all application endpoints, leading to potential information disclosure and circumvention of security controls."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-305",
                "description": "Authentication Bypass by Primary Weakness",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T12:08:53.173Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-40976"
          },
          {
            "name": "RHBZ#2463322",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463322"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40976.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-28T00:01:23.121Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-27T23:34:51.422Z",
            "value": "Made public."
          }
        ],
        "title": "Spring Boot: Spring Boot: Security bypass due to ineffective default web security",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this flaw, ensure that Spring Boot applications either implement their own Spring Security configuration, thereby not relying on the default web security filter chain, or include a dependency on `spring-boot-health`. Applications that do not meet all the specific conditions outlined for vulnerability are not affected. If `spring-boot-actuator-autoconfigure` is not strictly required, consider removing it."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "spring-boot-actuator-autoconfigure"
          ],
          "product": "Spring Boot",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn certain circumstances, Spring Boot\u0027s default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must:\u003c/p\u003e\u003cul\u003e\u003cli\u003ebe a servlet-based web application\u003c/li\u003e\u003cli\u003ehave no Spring Security configuration of its own and rely on the default web security filter chain\u003c/li\u003e\u003cli\u003edepend on \u003ccode\u003espring-boot-actuator-autoconfigure\u003c/code\u003e\u003c/li\u003e\u003cli\u003enot depend on \u003ccode\u003espring-boot-health\u003c/code\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eIf any of the above does not apply, the application is not vulnerable.\u003c/p\u003e\u003cp\u003eAffected: Spring Boot 4.0.0\u20134.0.5; upgrade to 4.0.6 or later per vendor advisory.\u003c/p\u003e"
            }
          ],
          "value": "In certain circumstances, Spring Boot\u0027s default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.\n\nAffected: Spring Boot 4.0.0\u20134.0.5; upgrade to 4.0.6 or later per vendor advisory."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Per CVSS v3.1: Confidentiality HIGH; Integrity HIGH; Availability NONE."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-27T23:34:51.422Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-40976"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-40976",
    "datePublished": "2026-04-27T23:34:51.422Z",
    "dateReserved": "2026-04-16T02:19:04.616Z",
    "dateUpdated": "2026-06-30T12:08:53.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-40976",
      "date": "2026-07-01",
      "epss": "0.00489",
      "percentile": "0.38451"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-40976\",\"sourceIdentifier\":\"security@vmware.com\",\"published\":\"2026-04-28T00:16:24.803\",\"lastModified\":\"2026-06-30T03:19:21.923\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In certain circumstances, Spring Boot\u0027s default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.\\n\\nAffected: Spring Boot 4.0.0\u20134.0.5; upgrade to 4.0.6 or later per vendor advisory.\"}],\"affected\":[{\"source\":\"security@vmware.com\",\"affectedData\":[{\"vendor\":\"Spring\",\"product\":\"Spring Boot\",\"defaultStatus\":\"unaffected\",\"modules\":[\"spring-boot-actuator-autoconfigure\"],\"versions\":[{\"version\":\"4.0.0\",\"lessThan\":\"4.0.6\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Clients\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:amq_clients:2023\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel - HawtIO 4\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:apache_camel_hawtio:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel for Spring Boot 4\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:camel_spring_boot:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of OptaPlanner 8\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:optaplanner:::el6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-28T00:00:00+00:00\",\"id\":\"CVE-2026-40976\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-305\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.0.6\",\"matchCriteriaId\":\"12A166C5-8B55-4BA3-AA8B-6024A257D441\"}]}]}],\"references\":[{\"url\":\"https://spring.io/security/cve-2026-40976\",\"source\":\"security@vmware.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-40976\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2463322\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40976.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-40976\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-28T13:54:43.454470Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-28T13:54:57.821Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Per CVSS v3.1: Confidentiality HIGH; Integrity HIGH; Availability NONE.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Spring\", \"modules\": [\"spring-boot-actuator-autoconfigure\"], \"product\": \"Spring Boot\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.0.6\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://spring.io/security/cve-2026-40976\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In certain circumstances, Spring Boot\u0027s default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.\\n\\nAffected: Spring Boot 4.0.0\\u20134.0.5; upgrade to 4.0.6 or later per vendor advisory.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn certain circumstances, Spring Boot\u0027s default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must:\u003c/p\u003e\u003cul\u003e\u003cli\u003ebe a servlet-based web application\u003c/li\u003e\u003cli\u003ehave no Spring Security configuration of its own and rely on the default web security filter chain\u003c/li\u003e\u003cli\u003edepend on \u003ccode\u003espring-boot-actuator-autoconfigure\u003c/code\u003e\u003c/li\u003e\u003cli\u003enot depend on \u003ccode\u003espring-boot-health\u003c/code\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eIf any of the above does not apply, the application is not vulnerable.\u003c/p\u003e\u003cp\u003eAffected: Spring Boot 4.0.0\\u20134.0.5; upgrade to 4.0.6 or later per vendor advisory.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"shortName\": \"vmware\", \"dateUpdated\": \"2026-04-27T23:34:51.422Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-40976\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-29T03:55:41.205Z\", \"dateReserved\": \"2026-04-16T02:19:04.616Z\", \"assignerOrgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"datePublished\": \"2026-04-27T23:34:51.422Z\", \"assignerShortName\": \"vmware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0488

Vulnerability from certfr_avis - Published: 2026-04-24 - Updated: 2026-04-24

De multiples vulnérabilités ont été découvertes dans Spring Boot. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Spring	Spring Boot	Boot versions 3.5.x antérieures à 3.5.14
Spring	Spring Boot	Boot versions 2.7.x antérieures à 2.7.33
Spring	Spring Boot	Boot versions 4.0.x antérieures à 4.0.6
Spring	Spring Boot	Boot versions 3.3.x antérieures à 3.3.19
Spring	Spring Boot	Boot versions 3.4.x antérieures à 3.4.16

References

Title

Publication Time

FKIE_CVE-2026-40976

Vulnerability from fkie_nvd - Published: 2026-04-28 00:16 - Updated: 2026-06-30 03:19

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

URL	Tags
security@vmware.com	https://spring.io/security/cve-2026-40976	Vendor Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/security/cve/CVE-2026-40976
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://bugzilla.redhat.com/show_bug.cgi?id=2463322
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40976.json

Impacted products

	Vendor	Product	Version
	vmware	spring_boot	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "spring-boot-actuator-autoconfigure"
          ],
          "product": "Spring Boot",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@vmware.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:jboss_data_grid:8"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat Data Grid 8",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:amq_broker:7"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat AMQ Broker 7",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:amq_clients:2023"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat AMQ Clients",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:apache_camel_hawtio:4"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat build of Apache Camel - HawtIO 4",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:camel_spring_boot:4"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat build of Apache Camel for Spring Boot 4",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:optaplanner:::el6"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat build of OptaPlanner 8",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat Fuse 7",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:7"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat JBoss Enterprise Application Platform 7",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat OpenShift Dev Spaces",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat Process Automation 7",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat Single Sign-On 7",
          "vendor": "Red Hat"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "12A166C5-8B55-4BA3-AA8B-6024A257D441",
              "versionEndExcluding": "4.0.6",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In certain circumstances, Spring Boot\u0027s default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.\n\nAffected: Spring Boot 4.0.0\u20134.0.5; upgrade to 4.0.6 or later per vendor advisory."
    }
  ],
  "id": "CVE-2026-40976",
  "lastModified": "2026-06-30T03:19:21.923",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "security@vmware.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40976",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-28T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-28T00:16:24.803",
  "references": [
    {
      "source": "security@vmware.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://spring.io/security/cve-2026-40976"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/security/cve/CVE-2026-40976"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463322"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40976.json"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security@vmware.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-305"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary"
    }
  ]
}

GHSA-8V8J-3HXP-93WR

Vulnerability from github – Published: 2026-04-28 00:31 – Updated: 2026-05-06 18:54

Summary

Spring Boot's default security filter chain has no authorization rule with Actuator but without Health

Details

Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.boot:spring-boot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40976"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T18:54:08Z",
    "nvd_published_at": "2026-04-28T00:16:24Z",
    "severity": "CRITICAL"
  },
  "details": "In certain circumstances, Spring Boot\u0027s default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.\n\nAffected: Spring Boot 4.0.0\u20134.0.5; upgrade to 4.0.6 or later per vendor advisory.",
  "id": "GHSA-8v8j-3hxp-93wr",
  "modified": "2026-05-06T18:54:08Z",
  "published": "2026-04-28T00:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40976"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spring-projects/spring-boot"
    },
    {
      "type": "WEB",
      "url": "https://spring.io/security/cve-2026-40976"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spring Boot\u0027s default security filter chain has no authorization rule with Actuator but without Health"
}

WID-SEC-W-2026-1263

Vulnerability from csaf_certbund - Published: 2026-04-23 22:00 - Updated: 2026-06-10 22:00

Summary

VMware Tanzu Spring Boot: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Spring Boot ist ein Framework zur Entwicklung von Java Anwendungen. Spring Boot basiert auf dem Spring Framework.

Angriff: Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Boot ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Daten zu manipulieren oder offenzulegen oder authentifizierte Benutzer zu kapern.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2026-40970

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40971

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40972

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40973

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40974

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40975

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40976

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40977

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

References

18 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://spring.io/blog/2026/04/23/spring-boot-3-5…	external
https://spring.io/blog/2026/04/23/spring-boot-4-0…	external
https://spring.io/security/cve-2026-40970	external
https://spring.io/security/cve-2026-40971	external
https://spring.io/security/cve-2026-40972	external
https://spring.io/security/cve-2026-40973	external
https://spring.io/security/cve-2026-40974	external
https://spring.io/security/cve-2026-40975	external
https://spring.io/security/cve-2026-40976	external
https://spring.io/security/cve-2026-40977	external
https://support.hcl-software.com/community?id=com…	external
https://access.redhat.com/errata/RHSA-2026:17668	external
https://access.redhat.com/errata/RHSA-2026:21772	external
https://access.redhat.com/errata/RHSA-2026:22619	external
https://www.ibm.com/support/pages/node/7275305	external
https://access.redhat.com/errata/RHSA-2026:25089	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Spring Boot ist ein Framework zur Entwicklung von Java Anwendungen. Spring Boot basiert auf dem Spring Framework.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Boot ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Daten zu manipulieren oder offenzulegen oder authentifizierte Benutzer zu kapern.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1263 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1263.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1263 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1263"
      },
      {
        "category": "external",
        "summary": "Spring Blog vom 2026-04-23",
        "url": "https://spring.io/blog/2026/04/23/spring-boot-3-5-14-available-now"
      },
      {
        "category": "external",
        "summary": "Spring Blog vom 2026-04-23",
        "url": "https://spring.io/blog/2026/04/23/spring-boot-4-0-6-available-now"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40970"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40971"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40972"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40973"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40974"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40975"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40976"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40977"
      },
      {
        "category": "external",
        "summary": "HCL Security Bulletin vom 2026-05-12",
        "url": "https://support.hcl-software.com/community?id=community_blog\u0026sys_id=2f600efd2bf4c7900c64f1a1d891bf19"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:17668 vom 2026-05-14",
        "url": "https://access.redhat.com/errata/RHSA-2026:17668"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:21772 vom 2026-05-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:21772"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:22619 vom 2026-06-02",
        "url": "https://access.redhat.com/errata/RHSA-2026:22619"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7275305 vom 2026-06-06",
        "url": "https://www.ibm.com/support/pages/node/7275305"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:25089 vom 2026-06-10",
        "url": "https://access.redhat.com/errata/RHSA-2026:25089"
      }
    ],
    "source_lang": "en-US",
    "title": "VMware Tanzu Spring Boot: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-06-10T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-11T10:26:04.306+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1263",
      "initial_release_date": "2026-04-23T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-04-23T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-04-27T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-25908, EUVD-2026-25936, EUVD-2026-25930, EUVD-2026-25941, EUVD-2026-25940, EUVD-2026-25939, EUVD-2026-25938, EUVD-2026-25937"
        },
        {
          "date": "2026-05-12T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2026-05-14T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-05-28T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-06-02T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-06-07T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-06-10T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "8"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "9.1.0-9.1.19.0",
                "product": {
                  "name": "HCL Commerce 9.1.0-9.1.19.0",
                  "product_id": "T053858",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Commerce"
          }
        ],
        "category": "vendor",
        "name": "HCL"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM Sterling Connect:Direct",
            "product": {
              "name": "IBM Sterling Connect:Direct",
              "product_id": "T045428",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:sterling_connect%3adirect:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Apache Camel for Spring Boot",
                "product": {
                  "name": "Red Hat Enterprise Linux Apache Camel for Spring Boot",
                  "product_id": "T040879",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Dev Spaces \u003c3.28.0",
                "product": {
                  "name": "Red Hat OpenShift Dev Spaces \u003c3.28.0",
                  "product_id": "T054838"
                }
              },
              {
                "category": "product_version",
                "name": "Dev Spaces 3.28.0",
                "product": {
                  "name": "Red Hat OpenShift Dev Spaces 3.28.0",
                  "product_id": "T054838-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:dev_spaces__3.28.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenShift"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.5.14",
                "product": {
                  "name": "VMware Tanzu Spring Boot \u003c3.5.14",
                  "product_id": "T053307"
                }
              },
              {
                "category": "product_version",
                "name": "3.5.14",
                "product": {
                  "name": "VMware Tanzu Spring Boot 3.5.14",
                  "product_id": "T053307-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_boot:3.5.14"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c4.0.6",
                "product": {
                  "name": "VMware Tanzu Spring Boot \u003c4.0.6",
                  "product_id": "T053308"
                }
              },
              {
                "category": "product_version",
                "name": "4.0.6",
                "product": {
                  "name": "VMware Tanzu Spring Boot 4.0.6",
                  "product_id": "T053308-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_boot:4.0.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spring Boot"
          }
        ],
        "category": "vendor",
        "name": "VMware Tanzu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-40970",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40970"
    },
    {
      "cve": "CVE-2026-40971",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40971"
    },
    {
      "cve": "CVE-2026-40972",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40972"
    },
    {
      "cve": "CVE-2026-40973",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40973"
    },
    {
      "cve": "CVE-2026-40974",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40974"
    },
    {
      "cve": "CVE-2026-40975",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40975"
    },
    {
      "cve": "CVE-2026-40976",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40976"
    },
    {
      "cve": "CVE-2026-40977",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40977"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-40976 (GCVE-0-2026-40976)

CERTFR-2026-AVI-0488

Solutions

FKIE_CVE-2026-40976

GHSA-8V8J-3HXP-93WR

WID-SEC-W-2026-1263

Tags

Sightings

Nomenclature