CVE-2026-40477: Thymeleaf Auth Bypass Vulnerability

CVE-2026-40477 Overview

CVE-2026-40477 is a critical Server-Side Template Injection (SSTI) vulnerability affecting Thymeleaf, a widely-used server-side Java template engine for web and standalone environments. The vulnerability exists in the expression execution mechanisms where the library fails to properly restrict the scope of accessible objects, allowing attackers to bypass built-in protections and reach potentially sensitive objects from within templates.

When application developers pass unvalidated user input directly to the Thymeleaf template engine, unauthenticated remote attackers can exploit this security bypass to achieve Server-Side Template Injection. This vulnerability class (CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement) is particularly dangerous as it can lead to remote code execution on the underlying server.

Critical Impact

Unauthenticated remote attackers can bypass Thymeleaf's expression injection protections to achieve Server-Side Template Injection (SSTI), potentially leading to remote code execution with the privileges of the application server.

Affected Products

• Thymeleaf versions 3.1.3.RELEASE and prior
• Java web applications using vulnerable Thymeleaf versions for template rendering
• Spring-based applications with Thymeleaf integration on affected versions

Discovery Timeline

• 2026-04-17 - CVE-2026-40477 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-40477

Vulnerability Analysis

This Server-Side Template Injection vulnerability stems from an incomplete security control implementation in Thymeleaf's expression execution mechanisms. While the library includes protections designed to prevent expression injection attacks, these safeguards fail to properly restrict the scope of objects accessible from within template expressions.

The vulnerability is classified under CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement), indicating that user-controlled input processed by the template engine is not adequately sanitized or restricted. This allows attackers to craft malicious expressions that can access sensitive objects and methods that should be restricted.

The attack requires network access and does not require authentication, though exploitation complexity is higher due to the need for specific conditions—namely, the application must pass unsanitized user input to the template engine. Successful exploitation can impact confidentiality, integrity, and availability of the target system, with the potential for scope change affecting resources beyond the vulnerable component.

Root Cause

The root cause of CVE-2026-40477 lies in insufficient object scope restrictions within Thymeleaf's expression evaluation context. Although the template engine implements mechanisms intended to prevent expression injection, the restriction logic does not comprehensively block access to all potentially dangerous objects.

Specifically, the expression sandbox allows certain Java objects and their methods to be reached through template expressions. When user-controlled data is incorporated into template expressions without proper validation, attackers can leverage these accessible objects to escape the intended sandbox and execute arbitrary code on the server.

Attack Vector

The attack vector requires an application that passes user-controlled input directly into Thymeleaf template expressions without proper sanitization. An unauthenticated attacker can submit crafted input through network-accessible endpoints such as form fields, URL parameters, or API requests.

The malicious input contains specially constructed Thymeleaf expression syntax designed to:

1. Navigate through accessible object references in the expression context
2. Reach Java reflection APIs or other dangerous classes not properly restricted
3. Execute arbitrary code or access sensitive system resources

The exploitation mechanism leverages the gap between the intended expression restrictions and the actual objects reachable through the expression evaluation context. For detailed technical information on the exploitation technique, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-40477

Indicators of Compromise

• Unusual Thymeleaf expression syntax in application logs, particularly containing object traversal patterns
• Unexpected system command execution originating from the Java application server process
• Application errors related to template parsing with suspicious expression content
• Network traffic containing potential SSTI payloads targeting Thymeleaf expression syntax

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common SSTI payload patterns targeting Thymeleaf
• Monitor application logs for template parsing errors or exceptions that may indicate exploitation attempts
• Deploy runtime application self-protection (RASP) solutions to detect malicious expression evaluation
• Conduct regular code reviews to identify locations where user input flows to template expressions

Monitoring Recommendations

• Enable verbose logging for the Thymeleaf template engine to capture expression evaluation details
• Monitor for outbound network connections or unusual process spawning from the application server
• Implement alerting for repeated template parsing failures from single source IPs
• Track application behavior anomalies that may indicate successful post-exploitation activity

How to Mitigate CVE-2026-40477

Immediate Actions Required

• Upgrade Thymeleaf to version 3.1.4.RELEASE or later, which contains the security fix
• Audit application code to identify all locations where user input is passed to template expressions
• Implement strict input validation and sanitization for any user-controlled data used in templates
• Consider implementing a Content Security Policy and additional defense-in-depth measures

Patch Information

The Thymeleaf development team has addressed this vulnerability in version 3.1.4.RELEASE. Organizations using affected versions should prioritize upgrading to this patched release immediately. The fix properly restricts the scope of accessible objects within template expressions, preventing unauthorized access to sensitive classes and methods.

For additional details on the security advisory and patch information, see the GitHub Security Advisory.

Workarounds

• Avoid passing any user-controlled input directly to Thymeleaf template expressions until patching is complete
• Implement server-side input validation using allowlists for acceptable values before template processing
• Deploy WAF rules specifically designed to block Thymeleaf SSTI attack patterns
• Consider running the application with reduced privileges to limit post-exploitation impact

# Maven dependency update example
# Update pom.xml to use patched Thymeleaf version
# Replace existing thymeleaf dependency version with 3.1.4.RELEASE

# For Maven projects, update the version in pom.xml:
# <dependency>
#     <groupId>org.thymeleaf</groupId>
#     <artifactId>thymeleaf</artifactId>
#     <version>3.1.4.RELEASE</version>
# </dependency>

# Verify the update
mvn dependency:tree | grep thymeleaf