CVE-2026-40976

[CVE catalog]

Severity

Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Published

Apr 23, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.49% · Oct 25, 2026

A flaw was found in Spring Boot. Under specific conditions, including being a servlet-based web application without custom Spring Security configuration and relying on the default web security filter chain, a remote attacker could bypass security. This allows unauthorized access to all application endpoints, leading to potential information disclosure and circumvention of security controls. Spring Boot: Spring Boot: Security bypass due to ineffective default web security This is an Important flaw in Spring Boot that allows security bypass under specific application configurations. When a servlet-based web application lacks custom Spring Security configuration, relies on the default web security filter chain, depends on `spring-boot-actuator-autoconfigure`, and does not include `spring-boot-health`, an attacker can gain unauthorized access to all application endpoints. Red Hat JBoss Data Grid (jdg-8.6) is affected by this vulnerability. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.