In certain circumstances, Spring Boot's default web security is ineffective allowing unaut

In certain circumstances

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on…

Do this now

Add explicit Spring Security configuration to servlet apps instead of relying on Spring Boot defaults.

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 20:17 UTC
Identifiers: CVE-2026-40976
CVSS: 9.1
Source: news
On the menu as: Java

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## In certain circumstances, Spring Boot's default web security is ineffective allowing unaut
Severity: critical. Patch status: fix status unknown.
Affected: In certain circumstances
Ids: CVE-2026-40976

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on…

## Steps
1. Search the repo, its CI and infra config for In certain circumstances. If present, report the version in use and whether it's affected.
2. There is no fix yet. Until one ships: In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on…

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-40976") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-40976 https://spring.io/security/cve-2026-40976
https://pwned.coffee/i/in-certain-circumstances-spring-boot-s-default-web-secur-cve-2026-40976

Timeline

23 Oct 2026, 20:17 UTC
Proof-of-concept code for CVE-2026-40976 is public on GitHub. Unverified, but expect scanning to follow.
23 Oct 2026
First reported.

Sources

Totalone very hot coffee