CVE-2026-22754: Spring Security Auth Bypass Vulnerability

CVE-2026-22754 Overview

CVE-2026-22754 is an authorization bypass vulnerability affecting Spring Security versions 7.0.0 through 7.0.4. When an application uses the <sec:intercept-url> element with the servlet-path attribute to define servlet paths for computing path matchers, the servlet path is incorrectly excluded from the authorization evaluation. This flaw allows attackers to bypass security rules and access protected endpoints without proper authorization.

Critical Impact

Applications relying on servlet-path-based authorization rules may be completely bypassed, potentially exposing sensitive endpoints and data to unauthorized access.

Affected Products

• Spring Security 7.0.0
• Spring Security 7.0.1
• Spring Security 7.0.2
• Spring Security 7.0.3
• Spring Security 7.0.4

Discovery Timeline

• 2026-04-22 - CVE-2026-22754 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-22754

Vulnerability Analysis

This authorization bypass vulnerability stems from improper handling of servlet path configurations in Spring Security's access control mechanism. The vulnerability is classified under CWE-284 (Improper Access Control), indicating a fundamental flaw in how the framework enforces authorization decisions.

When developers configure security rules using the <sec:intercept-url> element with a specified servlet-path attribute and a pattern attribute for URL matching, the framework fails to properly incorporate the servlet path into its path matching calculations. This disconnect between the configured security rules and the actual request path evaluation creates a gap that attackers can exploit to bypass authorization checks entirely.

The vulnerability requires network access but no authentication or user interaction, making it particularly dangerous for publicly accessible applications. Successful exploitation compromises the integrity of the application by allowing unauthorized modifications or access to protected resources.

Root Cause

The root cause lies in Spring Security's path matcher component failing to concatenate the servlet path with the endpoint pattern when evaluating incoming requests. When processing a security configuration like <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/>, the framework incorrectly evaluates only the pattern portion, completely ignoring the servlet-path prefix. This means requests to /servlet-path/endpoint/resource are not matched against the intended security rule, leaving them unprotected.

Attack Vector

The attack vector for CVE-2026-22754 is network-based, allowing remote attackers to exploit this vulnerability without any authentication credentials or user interaction.

An attacker can exploit this vulnerability by sending HTTP requests directly to protected endpoints. Since the servlet path is not included in the authorization decision, the security rules defined for those endpoints are never applied. For example, if an application intends to protect /api/admin/** endpoints with administrator-only access using the servlet-path configuration, an attacker could access these endpoints as an unauthenticated user or with lower privileges.

The exploitation involves crafting requests that target the protected endpoint patterns, which will be processed without the expected authorization checks being enforced. This is particularly dangerous for applications that rely on URL-based security patterns as their primary access control mechanism.

Detection Methods for CVE-2026-22754

Indicators of Compromise

• Unexpected access to protected endpoints from unauthenticated or low-privilege users in application logs
• Anomalous HTTP request patterns targeting endpoints that should require authentication
• Audit logs showing successful access to restricted resources without corresponding authentication events
• Increased traffic to administrative or sensitive endpoints from unexpected sources

Detection Strategies

• Review Spring Security configurations for usage of <sec:intercept-url> elements with servlet-path attributes
• Audit application access logs for unauthorized access patterns to protected resources
• Implement runtime monitoring for requests that successfully access protected endpoints without proper authorization tokens
• Deploy web application firewall rules to detect and alert on suspicious access attempts to sensitive endpoints

Monitoring Recommendations

• Enable detailed access logging for all Spring Security-protected endpoints
• Configure alerts for failed authentication attempts followed by successful access to the same resources
• Monitor for unusual traffic patterns to administrative or sensitive API endpoints
• Implement real-time log analysis to detect authorization bypass attempts

How to Mitigate CVE-2026-22754

Immediate Actions Required

• Audit all Spring Security configurations for usage of servlet-path attribute in <sec:intercept-url> elements
• Review and test authorization rules to ensure they are properly enforced
• Consider implementing additional authorization layers such as method-level security annotations
• Upgrade to a patched version of Spring Security when available

Patch Information

Refer to the Spring Security CVE-2026-22754 Advisory for official patch information and upgrade guidance. Organizations should monitor the Spring Security project for patched versions addressing this vulnerability and plan upgrades accordingly.

Workarounds

• Remove the servlet-path attribute from <sec:intercept-url> configurations and use full path patterns instead
• Implement method-level security using @PreAuthorize or @Secured annotations as an additional defense layer
• Configure security rules at the filter level without relying on servlet-path-based matching
• Deploy a web application firewall to enforce access control at the network perimeter as an interim measure

# Review Spring Security configuration files for affected patterns
grep -r "servlet-path" --include="*.xml" /path/to/application/
grep -r "intercept-url" --include="*.xml" /path/to/application/

# Check application dependencies for vulnerable Spring Security versions
mvn dependency:tree | grep spring-security
# or for Gradle
gradle dependencies | grep spring-security