CVE-2026-22733

What it actually does

CVE-2026-22733 is an authentication bypass in Spring Boot applications using Actuator when an application endpoint that should require authentication is declared under the path reserved for Cloud Foundry Actuator endpoints. In affected Spring Security/Spring Boot versions, request handling for that path can cause protected application endpoints to be treated as Cloud Foundry Actuator endpoints, allowing unauthenticated network attackers to reach functionality that the application intended to protect. The primary impact is unauthorized access to sensitive endpoint data or actions, with high confidentiality impact and limited integrity impact depending on what the exposed endpoint does.

Why it matters to the business

Organizations running affected Spring Boot applications may unintentionally expose administrative, diagnostic, or application-specific endpoints to the internet or internal networks without authentication. This can lead to leakage of configuration, operational data, application metadata, or sensitive business information, and in some cases may allow unauthorized changes if the exposed endpoint performs state-changing actions. Although this vulnerability is not currently listed in CISA KEV and has low EPSS at the time of assessment, it is remotely exploitable without credentials and affects a widely deployed enterprise application framework, so internet-facing applications and management endpoints should be prioritized.

How an attack unfolds

An attacker first identifies a Spring Boot application that exposes Actuator or application endpoints over HTTP. They then enumerate paths associated with Cloud Foundry Actuator endpoint routing and look for application-defined endpoints placed under that path. If a protected endpoint is incorrectly declared beneath the Cloud Foundry Actuator path, the attacker sends unauthenticated requests directly to that endpoint. Because the vulnerable security handling misclassifies or mishandles the request path, the request can bypass the expected authentication requirement. The attacker can then read sensitive responses or invoke any exposed endpoint behavior allowed by the vulnerable route, potentially collecting configuration details, service metadata, health information, or triggering limited application-side changes depending on endpoint functionality.

How to fix it

Upgrade affected Spring Boot/Spring Security components to versions that contain the vendor fix once available for the relevant maintained branch. The reported affected ranges are Spring Security/Spring Boot lines from 4.0.0 through 4.0.3, 3.5.0 through 3.5.11, 3.4.0 through 3.4.14, 3.3.0 through 3.3.17, and 2.7.0 through 2.7.31. Because exact fixed versions were not provided in the input, consult the official Spring advisory and upgrade to the first non-affected release for the deployed branch. As an immediate mitigation, ensure no application-defined authenticated endpoint is declared under the Cloud Foundry Actuator endpoint path, restrict Actuator exposure to trusted networks, require authentication and authorization at an upstream gateway or reverse proxy, disable unnecessary Actuator endpoints, and explicitly configure `management.endpoints.web.exposure.include` to expose only required endpoints. For internet-facing services, block direct access to management paths except from administrative networks or authenticated control planes.

How to confirm the fix worked

Inventory applications using Spring Boot Actuator and identify deployed Spring Boot/Spring Security versions. Confirm that no deployed application is running within the affected version ranges or, if it is, that compensating controls prevent unauthenticated access to affected paths. Review route mappings and endpoint registrations to ensure application-defined authenticated endpoints are not placed under the Cloud Foundry Actuator path. From an unauthenticated client, attempt to access management and Cloud Foundry Actuator paths and verify that protected endpoints consistently return 401, 403, or an equivalent authentication challenge rather than application data. Validate reverse proxy, API gateway, ingress, and service mesh rules to confirm management paths are not publicly reachable. Include regression tests that assert protected endpoint paths beneath management namespaces cannot be accessed without valid credentials.

Typical attack path

1. Discover a Spring Boot application exposed on a network-accessible HTTP or HTTPS service.
2. Probe common Actuator and Cloud Foundry Actuator paths to determine whether Actuator routing is enabled or reachable.
3. Enumerate endpoints under the Cloud Foundry Actuator path and identify application-defined endpoints that should normally require authentication.
4. Send unauthenticated HTTP requests to the affected endpoint path.
5. Review responses for sensitive data, configuration details, internal service information, or accessible application functions.
6. If the endpoint supports state-changing operations, attempt unauthorized actions within the endpoint’s exposed capabilities.

How to detect it

To determine whether this was already exploited, review HTTP access logs from applications, API gateways, load balancers, reverse proxies, ingress controllers, WAFs, and service meshes for unauthenticated requests to Actuator and Cloud Foundry Actuator paths. Focus on requests that returned HTTP 200, 2xx, or unexpected 3xx responses to paths that should require authentication, especially where no authenticated user identity, session, bearer token, mTLS identity, or authorization header was present. Look for endpoint enumeration patterns such as repeated probes of `/actuator`, `/actuator/*`, `/cloudfoundryapplication`, and `/cloudfoundryapplication/*`, followed by successful access to application-specific subpaths. Correlate successful requests with downstream application logs showing sensitive endpoint execution, configuration reads, diagnostic data access, or state-changing actions. Because no public exploit maturity or named threat actor activity is provided, detection should emphasize abnormal unauthenticated access patterns rather than actor-specific infrastructure.

• GET /cloudfoundryapplication
• POST /cloudfoundryapplication
• PUT /cloudfoundryapplication
• DELETE /cloudfoundryapplication
• GET /cloudfoundryapplication/
• POST /cloudfoundryapplication/
• /cloudfoundryapplication/actuator
• /cloudfoundryapplication/env
• /cloudfoundryapplication/configprops
• /cloudfoundryapplication/beans
• /cloudfoundryapplication/mappings
• /cloudfoundryapplication/health
• /cloudfoundryapplication/info
• /cloudfoundryapplication/metrics
• /cloudfoundryapplication/loggers
• /cloudfoundryapplication/threaddump
• /cloudfoundryapplication/heapdump
• /actuator/env
• /actuator/configprops
• /actuator/beans
• /actuator/mappings
• /actuator/heapdump

What your security team should do

• Prioritize review of internet-facing Spring Boot applications that expose Actuator or management endpoints.
• Upgrade affected Spring Boot/Spring Security versions to fixed vendor releases as soon as they are available for the deployed branch.
• Immediately restrict network access to Actuator and Cloud Foundry Actuator paths using ingress, gateway, WAF, or reverse-proxy controls.
• Audit application route definitions for authenticated endpoints declared beneath Cloud Foundry Actuator paths and move them outside reserved management namespaces.
• Disable unnecessary Actuator endpoints and use least-privilege exposure settings for management endpoints.
• Add unauthenticated access tests for all management and sensitive application endpoints to CI/CD security validation.
• Search historical access logs for unauthenticated requests to Cloud Foundry Actuator paths and unusual enumeration of management endpoints.
• Monitor vendor advisories for exact fixed versions and update SBOM, dependency scanning, and policy checks accordingly.