GHSA-8hfc-fq58-r658

Suggest an improvement
Source
https://github.com/advisories/GHSA-8hfc-fq58-r658
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8hfc-fq58-r658/GHSA-8hfc-fq58-r658.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-8hfc-fq58-r658
Aliases
Downstream
CGA (10)
MINI (1)
Published
2026-03-20T00:31:28Z
Modified
2026-07-17T21:10:27Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Spring Boot has an Authentication Bypass under Actuator Health groups paths
Details

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

Database specific 
{
    "cwe_ids": [
        "CWE-288",
        "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T20:41:29Z",
    "nvd_published_at": "2026-03-19T23:16:41Z",
    "severity": "HIGH"
}
References

Affected packages

Maven
org.springframework.boot:spring-boot-starter-actuator

Package

Name
org.springframework.boot:spring-boot-starter-actuator
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.boot/spring-boot-starter-actuator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.4.0
Last Affected
3.4.13

Affected versions

3.*
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.4.10
3.4.11
3.4.12
3.4.13

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8hfc-fq58-r658/GHSA-8hfc-fq58-r658.json"
org.springframework.boot:spring-boot-starter-actuator

Package

Name
org.springframework.boot:spring-boot-starter-actuator
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.boot/spring-boot-starter-actuator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.5.0
Fixed
3.5.12

Affected versions

3.*
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.5.10
3.5.11

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8hfc-fq58-r658/GHSA-8hfc-fq58-r658.json"
org.springframework.boot:spring-boot-starter-actuator

Package

Name
org.springframework.boot:spring-boot-starter-actuator
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.boot/spring-boot-starter-actuator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0-M1
Fixed
4.0.4

Affected versions

4.*
4.0.0-M1
4.0.0-M2
4.0.0-M3
4.0.0-RC1
4.0.0-RC2
4.0.0
4.0.1
4.0.2
4.0.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8hfc-fq58-r658/GHSA-8hfc-fq58-r658.json"