CVE-2026-40976

A flaw was found in Spring Boot. Under specific conditions, including being a servlet-based web application without custom Spring Security configuration and relying on the default web security filter chain, a remote attacker could bypass security. This allows unauthorized access to all application endpoints, leading to potential information disclosure and circumvention of security controls.

This is an Important flaw in Spring Boot that allows security bypass under specific application configurations. When a servlet-based web application lacks custom Spring Security configuration, relies on the default web security filter chain, depends on spring-boot-actuator-autoconfigure, and does not include spring-boot-health, an attacker can gain unauthorized access to all application endpoints. Red Hat JBoss Data Grid (jdg-8.6) is affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this flaw, ensure that Spring Boot applications either implement their own Spring Security configuration, thereby not relying on the default web security filter chain, or include a dependency on spring-boot-health. Applications that do not meet all the specific conditions outlined for vulnerability are not affected. If spring-boot-actuator-autoconfigure is not strictly required, consider removing it.