CVE-2026-40976
Spring Boot versions 4.0.0 through 4.0.5 have a flaw that lets anyone access all web endpoints when the application uses the default security settings. The issue only appears in servlet‑based apps that don’t add their own Spring Security configuration and that include the actuator autoconfigure module. An attacker can read or modify data without authentication.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Spring Boot 4.0.0–4.0.5 servlet‑based web applications that rely on the default security filter chain, have no custom Spring Security configuration, and include spring‑boot‑actuator‑autoconfigure but not spring‑boot‑health. Developers deploying these versions without additional security measures are at risk.
Real-world impact
An attacker who can reach the application can read sensitive data, change configuration, or perform actions that normally require authentication, effectively taking full control of the web service.
Why this severity
The CVSS score of 9.1 reflects that no authentication or user interaction is needed, and the vulnerability can compromise both confidentiality and integrity of the application data.
What to do about it
- 01Upgrade Spring Boot to version 4.0.6 or later.
- 02Restart the application to apply the new version.
NVD-referenced vendor advisory
Timeline
- Apr 28, 2026 · Apr 28, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.