Skip to content

Product

org.springframework.boot/spring-boot-starter-actuator vulnerabilities

2 published CVES affecting org.springframework.boot/spring-boot-starter-actuator, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
2
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest org.springframework.boot/spring-boot-starter-actuator CVEs

Newest publication first

  1. CVE-2026-22733 Authentication Bypass under Actuator CloudFoundry endpoints

    Published
    HighCVSS 8.1 EPSS 0.38%

    Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 th...

  2. CVE-2026-22731 Authentication Bypass under Actuator Health groups paths

    Published
    HighCVSS 8.1 EPSS 0.35%

    Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot:...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.