Two High-Severity Spring Boot Flaws Expose Actuator Endpoints

Security researchers disclosed two high-severity authentication-bypass vulnerabilities in Spring Boot Actuator (CVE-2026-22731 and CVE-2026-22733, CVSS 8.2) that can grant unauthorized access when custom application endpoints are mapped under Actuator or CloudFoundry Actuator paths; multiple Spring Boot release branches are affected and mitigations include updating to fixed versions and avoiding mapping application logic under infrastructure endpoints.