CVE-2026-40976: VMware Spring Boot Auth Bypass Flaw

CVE-2026-40976 Overview

CVE-2026-40976 is a critical authorization bypass vulnerability in VMware Spring Boot that renders the framework's default web security ineffective under specific conditions. When exploited, this flaw allows unauthenticated attackers to gain unauthorized access to all application endpoints, including sensitive actuator endpoints that may expose configuration data, health metrics, and administrative functions.

For an application to be vulnerable, it must meet all of the following criteria: be a servlet-based web application, have no custom Spring Security configuration and rely on the default web security filter chain, depend on spring-boot-actuator-autoconfigure, and not depend on spring-boot-health. If any of these conditions does not apply, the application is not vulnerable.

Critical Impact

Unauthenticated remote attackers can bypass security controls to access all application endpoints, potentially leading to sensitive data exposure, configuration manipulation, and complete application compromise.

Affected Products

• VMware Spring Boot 4.0.0
• VMware Spring Boot 4.0.1 through 4.0.5
• Applications using spring-boot-actuator-autoconfigure without custom Spring Security configuration

Discovery Timeline

• 2026-04-28 - CVE-2026-40976 published to NVD
• 2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-40976

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating a fundamental flaw in how Spring Boot's default security filter chain handles authorization checks. The issue arises from a specific combination of dependencies and configuration states that creates a gap in the security enforcement mechanism.

The vulnerability manifests when applications rely solely on Spring Boot's auto-configured security defaults while using the actuator autoconfigure module. Under these conditions, the default web security filter chain fails to properly enforce authentication and authorization requirements, leaving all endpoints—including actuator endpoints that expose sensitive operational data—accessible without credentials.

The network-accessible nature of this vulnerability means attackers can exploit it remotely without requiring any prior authentication or user interaction. Successful exploitation can lead to complete confidentiality and integrity compromise of the affected application.

Root Cause

The root cause lies in a misconfiguration or conflict between the spring-boot-actuator-autoconfigure module and Spring Boot's default security filter chain when no explicit Spring Security configuration is present. The absence of the spring-boot-health dependency appears to trigger a code path where the default security constraints are not properly applied, resulting in all endpoints being exposed without authentication requirements.

This represents a failure in the framework's security-by-default principle, where the combination of specific dependency states creates an unintended security gap in the auto-configuration logic.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by simply sending HTTP requests to any endpoint on a vulnerable Spring Boot application.

The exploitation flow involves:

1. Identifying a Spring Boot application running an affected version (4.0.0 through 4.0.5)
2. Accessing actuator endpoints such as /actuator/env, /actuator/configprops, or /actuator/mappings without authentication
3. Extracting sensitive configuration data, credentials, or application secrets from the exposed endpoints
4. Using gathered information for further attacks or directly manipulating application behavior through writable actuator endpoints

Due to the nature of this vulnerability, no code example is required—the attack simply involves making unauthenticated HTTP requests to normally protected endpoints. For detailed technical information, refer to the Spring Security Advisory CVE-2026-40976.

Detection Methods for CVE-2026-40976

Indicators of Compromise

• Unexpected unauthenticated access to actuator endpoints in application access logs
• HTTP 200 responses for requests to /actuator/* endpoints from unknown or external IP addresses
• Access log entries showing enumeration patterns across multiple actuator endpoints
• Unusual configuration queries or environment variable access attempts

Detection Strategies

• Monitor web server access logs for requests to actuator endpoints without valid authentication tokens or sessions
• Implement anomaly detection for access patterns to sensitive endpoints such as /actuator/env, /actuator/configprops, and /actuator/beans
• Deploy web application firewall rules to alert on actuator endpoint access from untrusted sources
• Review application dependency manifests for vulnerable Spring Boot versions (4.0.0 through 4.0.5)

Monitoring Recommendations

• Enable detailed access logging for all actuator endpoints with source IP, user agent, and response code tracking
• Configure alerts for successful access to actuator endpoints without authentication context
• Implement real-time monitoring for mass endpoint enumeration behavior
• Establish baseline access patterns for actuator endpoints to identify anomalous activity

How to Mitigate CVE-2026-40976

Immediate Actions Required

• Upgrade all affected Spring Boot applications to version 4.0.6 or later immediately
• Audit application dependencies to confirm whether the vulnerable configuration conditions apply
• Implement explicit Spring Security configuration if upgrade is not immediately possible
• Restrict network access to actuator endpoints using firewall rules or reverse proxy configuration

Patch Information

VMware has released Spring Boot 4.0.6 to address this vulnerability. Organizations should upgrade all affected applications from versions 4.0.0 through 4.0.5 to the patched version. The official vendor advisory is available at the Spring Security Advisory.

To verify your application is no longer vulnerable after upgrading:

1. Confirm the Spring Boot version in your pom.xml or build.gradle shows 4.0.6 or later
2. Test that actuator endpoints return 401 Unauthorized or 403 Forbidden when accessed without credentials
3. Review application startup logs for proper security filter chain initialization

Workarounds

• Add explicit Spring Security configuration to your application instead of relying on defaults
• Add the spring-boot-health dependency to change the vulnerable code path
• Disable or restrict actuator endpoints by setting management.endpoints.enabled-by-default=false
• Configure actuator endpoint exposure explicitly using management.endpoints.web.exposure.include

# Example application.properties workaround configuration
# Disable all actuator endpoints by default
management.endpoints.enabled-by-default=false

# Only enable specific endpoints if needed
management.endpoint.health.enabled=true
management.endpoint.info.enabled=true

# Restrict web exposure
management.endpoints.web.exposure.include=health,info

# Require authentication for actuator endpoints
management.endpoints.web.base-path=/actuator
spring.security.user.name=actuator-admin
spring.security.user.password=${ACTUATOR_PASSWORD}