CVE-2026-40976: Critical severity VMware Spring Boot vulnerability
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.
Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Bootto a version that resolves this vulnerability.Fixed in 4.0.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40976?
CVE-2026-40976 is classified as a medium severity vulnerability due to its potential for unauthorized access to sensitive endpoints.
How do I fix CVE-2026-40976?
To fix CVE-2026-40976, implement explicit Spring Security configuration in your servlet-based web application to secure all endpoints.
Which versions of VMware Spring Boot are affected by CVE-2026-40976?
CVE-2026-40976 affects VMware Spring Boot versions 4.0.0 to 4.0.5 if no custom Spring Security configuration is applied.
What are the consequences of not addressing CVE-2026-40976?
If CVE-2026-40976 is not addressed, unauthorized users may gain access to all endpoints of your application, posing a significant security risk.
Is CVE-2026-40976 easy to exploit?
Yes, CVE-2026-40976 can be easily exploited in applications that rely solely on default web security without any custom configurations.