CVE-2026-22733
HighAdvisory
Published 20 Mar 2026In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.2
- base score, highest
- EPSS
- 0.004
- 29th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 147
- of 17,781 indexed, latest versions
- Container images
- 84
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints
Carried by container images the latest versions of 147 of 17,781 indexed charts deploy, on 84 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| spring-boot-starter-actuatormaven | 1.4.4.RELEASE, 1.5.3.RELEASE, 1.5.11.RELEASE, 1.5.15.RELEASE+40 more | 3.5.12, 4.0.4 | 84 |
- OSV records
- GHSA-mgvc-8q2h-5pgc
Charts affected
147 by stars
Container images carrying it
84 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| dellcloud/ | 6ba7b22caacd | spring-boot-starter-actuator | no fix listed | 79 |
| apache/ | e8b7c4ddd069 | spring-boot-starter-actuator | no fix listed | 3 |
| apache/ | 0bd3b25c4be4 | spring-boot-starter-actuator | no fix listed | 3 |
| apache/ | a83cf1980609 | spring-boot-starter-actuator | no fix listed | 2 |
| apache/ | 7cdfd8deec92 | spring-boot-starter-actuator | no fix listed | 2 |
| apachepulsar/ | b341ef76a852 | spring-boot-starter-actuator | no fix listed | 2 |
| geoservercloud/ | 756559ee788a | spring-boot-starter-actuator | no fix listed | 2 |
| geoservercloud/ | 99540eef78ad | spring-boot-starter-actuator | no fix listed | 2 |
| geoservercloud/ | 5c254c53a357 | spring-boot-starter-actuator | no fix listed | 2 |
| geoservercloud/ | c687b1cbc891 | spring-boot-starter-actuator | no fix listed | 2 |
| geoservercloud/ | 5288f320cf36 | spring-boot-starter-actuator | no fix listed | 2 |
| geoservercloud/ | a30a60ac6cd0 | spring-boot-starter-actuator | no fix listed | 2 |
| nacos/ | dcf04549c6d7 | spring-boot-starter-actuator | no fix listed | 2 |
| obsidiandynamics/ | 5337c9e0e2de | spring-boot-starter-actuator | no fix listed | 2 |
| piomin/ | 871f784dd6bc | spring-boot-starter-actuator | no fix listed | 2 |
| scorpiobroker/ | c46c1517e523 | spring-boot-starter-actuator | no fix listed | 2 |
| 2martens/ | bf1cdb80239d | spring-boot-starter-actuator | no fix listed | 1 |
| 2martens/ | bd1ba6ab84c9 | spring-boot-starter-actuator | 3.5.12 | 1 |
| 2martens/ | ba2c3040dab0 | spring-boot-starter-actuator | 3.5.12 | 1 |
| andrianrf/ | 46abe878d9d8 | spring-boot-starter-actuator | no fix listed | 1 |
| andrianrf/ | b63fdb51d39d | spring-boot-starter-actuator | no fix listed | 1 |
| andrianrf/ | ba560086ce15 | spring-boot-starter-actuator | no fix listed | 1 |
| andrianrf/ | 7da47f525c7d | spring-boot-starter-actuator | no fix listed | 1 |
| apache/ | 75d48a62748f | spring-boot-starter-actuator | no fix listed | 1 |
| apache/ | a2bab1be574c | spring-boot-starter-actuator | no fix listed | 1 |
| apache/ | 090b7f87ec7f | spring-boot-starter-actuator | no fix listed | 1 |
| apache/ | 63b8e3e40742 | spring-boot-starter-actuator | no fix listed | 1 |
| apache/ | 974efa2f21da | spring-boot-starter-actuator | no fix listed | 1 |
| apacherocketmq/ | 24799aff6cf8 | spring-boot-starter-actuator | no fix listed | 1 |
| apache/ | e2be712fc4f4 | spring-boot-starter-actuator | no fix listed | 1 |
| apache/ | 1bd5756f6273 | spring-boot-starter-actuator | no fix listed | 1 |
| apache/ | 67d50e4deff4 | spring-boot-starter-actuator | no fix listed | 1 |
| audig/ | 2c3fe34ee430 | spring-boot-starter-actuator | no fix listed | 1 |
| binhex/ | fb8952921ab6 | spring-boot-starter-actuator | no fix listed | 1 |
| choerodon/ | 3c94c97f6f69 | spring-boot-starter-actuator | no fix listed | 1 |
| commerceexperts/ | 9e33ad89baf6 | spring-boot-starter-actuator | no fix listed | 1 |
| dniel/ | f67129ea1c64 | spring-boot-starter-actuator | no fix listed | 1 |
| fimperato/ | 604012b77841 | spring-boot-starter-actuator | no fix listed | 1 |
| geonetwork/ | 20c9bb761f67 | spring-boot-starter-actuator | no fix listed | 1 |
| geoservercloud/ | ca58b74529cd | spring-boot-starter-actuator | no fix listed | 1 |
| geoservercloud/ | 5dc0c93a1710 | spring-boot-starter-actuator | no fix listed | 1 |
| geoservercloud/ | 47ae1bdb4bcc | spring-boot-starter-actuator | no fix listed | 1 |
| geoservercloud/ | 28c3e5a8c5a3 | spring-boot-starter-actuator | no fix listed | 1 |
| geoservercloud/ | 8c70ee06d5ab | spring-boot-starter-actuator | no fix listed | 1 |
| geoservercloud/ | 42775ba6a4da | spring-boot-starter-actuator | no fix listed | 1 |
| jhipster/ | 7184525acd4d | spring-boot-starter-actuator | no fix listed | 1 |
| just1not2/ | 8a2305192dec | spring-boot-starter-actuator | no fix listed | 1 |
| kimb88/ | 0639155241cb | spring-boot-starter-actuator | no fix listed | 1 |
| krontechnology/ | 7feef7d2ab42 | spring-boot-starter-actuator | no fix listed | 1 |
| ladeit/ | 962b665ffe82 | spring-boot-starter-actuator | no fix listed | 1 |