StackRadar

CVE-2026-22731

High

Advisory

Published 20 Mar 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.003
26th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
7
of 17,781 indexed, latest versions
Container images
7
deployed by those charts
Fix available
1 of 1
affected package

Spring Boot has an Authentication Bypass under Actuator Health groups paths

Carried by container images the latest versions of 7 of 17,781 indexed charts deploy, on 7 images.

Affected packageAffected versionsFixed inImages
spring-boot-starter-actuatormaven3.4.2, 3.4.4, 3.5.4, 3.5.5+2 more3.5.12, 4.0.47
OSV records
GHSA-8hfc-fq58-r658

Charts affected

7 by stars
ChartLatestAffected imagesRadar Score
hertzbeathertzbeatOfficialVerified publisher1.8.12 of 4See more

hertzbeat hertzbeat 1.8.1

2 of the 4 container images this version deploys carry CVE-2026-22731.

Container imageDigestPackageFixed in
apache/hertzbeat:1.8.075d48a62748f
spring-boot-starter-actuator@3.4.2
no fix listed
apache/hertzbeat-collector:1.8.0a2bab1be574c
spring-boot-starter-actuator@3.4.2
no fix listed

Open the chart page →

14,000
eximeebpmseximeebpms-k8sOfficialVerified publisher0.3.01 of 1See more

eximeebpms eximeebpms-k8s 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-22731.

Container imageDigestPackageFixed in
ghcr.io/eximeebpms/eximeebpms-bpm-platform:run-1.3.0acb8dbce38fd
spring-boot-starter-actuator@4.0.3
4.0.4

Open the chart page →

727
fineractfineract-openshift0.1.11 of 4See more

fineract fineract-openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-22731.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
spring-boot-starter-actuator@3.4.4
no fix listed

Open the chart page →

7,792
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-22731.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
spring-boot-starter-actuator@3.4.4
no fix listed

Open the chart page →

7,792
sn-consolestreamnative1.13.01 of 1See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-22731.

Container imageDigestPackageFixed in
streamnative/private-cloud-console:v2.3.27-all91e54375e154
spring-boot-starter-actuator@3.5.5
3.5.12

Open the chart page →

1,827
timetabletwomartensVerified publisher0.2.01 of 1See more

timetable twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-22731.

Container imageDigestPackageFixed in
2martens/timetable:latestbd1ba6ab84c9
spring-boot-starter-actuator@3.5.6
3.5.12

Open the chart page →

1,527
wahlrechttwomartensVerified publisher0.3.01 of 1See more

wahlrecht twomartens 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-22731.

Container imageDigestPackageFixed in
2martens/wahlrecht:latestba2c3040dab0
spring-boot-starter-actuator@3.5.4
3.5.12

Open the chart page →

1,689

Container images carrying it

7 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/fineract:1.12.1a83cf1980609
spring-boot-starter-actuator@3.4.4
no fix listed
2
2martens/timetable:latestbd1ba6ab84c9
spring-boot-starter-actuator@3.5.6
3.5.12
1
2martens/wahlrecht:latestba2c3040dab0
spring-boot-starter-actuator@3.5.4
3.5.12
1
apache/hertzbeat:1.8.075d48a62748f
spring-boot-starter-actuator@3.4.2
no fix listed
1
apache/hertzbeat-collector:1.8.0a2bab1be574c
spring-boot-starter-actuator@3.4.2
no fix listed
1
streamnative/private-cloud-console:v2.3.27-all91e54375e154
spring-boot-starter-actuator@3.5.5
3.5.12
1
ghcr.io/eximeebpms/eximeebpms-bpm-platform:run-1.3.0acb8dbce38fd
spring-boot-starter-actuator@4.0.3
4.0.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.