DeutschShown in its original language — a full translation is planned for a future version.
VMware Tanzu Spring Security: Mehrere Schwachstellen
view advisory published 2026-04-21
Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Security ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, sich als Benutzer auszugeben oder Daten zu manipulieren – was möglicherweise eine Privilegieneskalation, SSRF- oder Cross-Site-Scripting-Angriffe ermöglicht.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-22752US | — | — | ||
Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server.
This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, f… | ||||
| CVE-2026-22754US | — | — | ||
Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a… | ||||
| CVE-2026-22753US | — | — | ||
Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching reques… | ||||
| CVE-2026-22748US | medium6.5 | — | ||
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<J… | ||||
| CVE-2026-22747US | high8.1 | Exploit | ||
Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong… | ||||
| CVE-2026-22746US | — | — | ||
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or l… | ||||
| CVE-2026-22751US | — | — | ||
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOC… | ||||
02
references
External citations — patches, advisories, analysis.
- Spring Security 2026.04 Releases vom 2026-04-21external
- Spring CVE-2026-22746 vom 2026-04-21external
- Spring CVE-2026-22747 vom 2026-04-21external
- Spring CVE-2026-22748 vom 2026-04-21external
- Spring CVE-2026-22751 vom 2026-04-21external
- Spring CVE-2026-22752 vom 2026-04-21external
- Spring CVE-2026-22753 vom 2026-04-21external
- Spring CVE-2026-22754 vom 2026-04-21external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan