A critical authentication bypass vulnerability in Spring Boot Actuator allows unauthenticated attackers to access restricted application endpoints.

The flaw is an authentication bypass (CWE-288) occurring when application endpoints requiring authentication are configured under the path used by CloudFoundry Actuator, allowing unauthenticated remote attackers to circumvent security controls.

The ability for unauthenticated users to access protected internal application endpoints poses a significant risk of unauthorized data disclosure and potential exposure of administrative functions. Given the CVSS score of 8.2, this vulnerability is classified as high severity, as it permits attackers to interact with sensitive system paths without providing valid credentials.

Immediate Action: Update Spring Boot to the patched versions (4.0.4 or 3.5.12) as identified in the vendor security advisory.

Proactive Monitoring: Review application access logs for unexpected requests targeting Actuator or CloudFoundry paths and monitor for unauthorized access attempts to sensitive administrative endpoints.

Compensating Controls: Implement strict network access controls or Web Application Firewall (WAF) rules to block external access to all Actuator and management endpoints until patches can be deployed.

Public Exploit Available: No confirmed public exploit (false).

Organizations utilizing Spring Boot with Actuator should prioritize upgrading to the latest secure releases immediately. Given the high CVSS score and the potential for unauthenticated access, testing and deployment of these patches should be treated as a high-priority maintenance task to prevent potential exploitation.