A critical authentication bypass vulnerability in Spring Boot Actuator allows unauthenticated attackers to access sensitive endpoints, posing a significant risk to application integrity and data confidentiality.

This vulnerability, categorized as CWE-288, occurs due to an authentication bypass flaw triggered when an authenticated endpoint is declared under a path already configured for a Health Group. The flaw permits unauthenticated remote attackers to interact with restricted Actuator endpoints.

Successful exploitation of this vulnerability allows unauthorized access to sensitive application data or internal configuration details, which could facilitate further attacks. Given the CVSS score of 8.2, this issue presents a high risk to business operations, potentially leading to unauthorized data disclosure and the compromise of internal service health metrics.

Immediate Action: Update Spring Boot to version 4.0.4, 3.5.12, or the latest available maintenance release to resolve the authentication bypass.

Proactive Monitoring: Monitor application access logs for unusual requests directed at Actuator endpoints, particularly those originating from unauthorized or external IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) to restrict access to the Actuator path prefix, ensuring that only trusted internal traffic can reach these endpoints until the application is patched.

Public Exploit Available: No (exploit_available: unknown)

Organizations utilizing Spring Boot with Actuator enabled must prioritize this update, as the vulnerability allows for unauthenticated access to potentially sensitive system information. Apply the vendor-provided patches immediately to ensure that endpoint security configurations are properly enforced and to prevent unauthorized exposure of internal application data.