Spring Security 7.0.07.0.4: Auth ByPass via Servlet Path
CVE-2026-22754 Published on April 22, 2026

ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules
Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.

NVD

Vulnerability Analysis

CVE-2026-22754 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Types

What is an Authorization Vulnerability?

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVE-2026-22754 has been classified to as an Authorization vulnerability or weakness.

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection. For instance, the character strings /./ and / both mean current directory. If /SomeDirectory is a protected directory and an attacker requests /./SomeDirectory, the attacker may be able to gain access to the resource if /./ is not converted to / before the authorization check is performed.


Products Associated with CVE-2026-22754

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-22754 are published in these products:

VMware Spring Framework
 
Red Hat Ocp Tools
 
Red Hat Apache Camel Hawtio
 
Red Hat Camel Spring Boot
 
Red Hat Quarkus
 
Red Hat Jboss Data Grid
 
Red Hat Jboss Fuse
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Jbosseapxp
 
Red Hat Openshift Devspaces
 
Red Hat Jboss Enterprise Bpms Platform
 
Red Hat Single Sign On
 
Oracle
 

Affected Versions

Spring Security: Red Hat OpenShift Developer Tools and Services: Red Hat OpenShift Developer Tools and Services: Red Hat OpenShift Developer Tools and Services: Red Hat build of Apache Camel for Spring Boot 4: Red Hat build of Apache Camel - HawtIO 4: Red Hat build of Quarkus: Red Hat Data Grid 8: Red Hat Fuse 7: Red Hat Fuse 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat OpenShift Dev Spaces: Red Hat OpenShift Dev Spaces: Red Hat Process Automation 7: Red Hat Single Sign-On 7:

Exploit Probability

EPSS
0.27%
Percentile
18.63%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.