Security Advisory

CVE-2026-22731

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-03-19 22:36:15

Last updated 2026-03-20 15:33:43

Assigner vmware

State PUBLISHED

Description

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

← Browse all CVEs View on cve.org ↗