Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 12 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-693.
Summary
Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication, authorization, and other security controls being rendered inactive on intended requests.This issue affects Spring Security: from 7.0.0 through 7.0.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Spring Security | 7.0.0 – 7.0.4 | — | No fix listed | CNA |
| — | org.springframework.security:spring-security-config (Maven) | 7.0.0 to before 7.0.5 | 7.0.5 | Patch available | GHSA-4wrg-8wpc-h923 |
- Spring Security VendorVMware Affected 7.0.0 – 7.0.4 Fixed in — No fix listed CNA
- org.springframework.security:spring-security-config (Maven) Vendor— Affected 7.0.0 to before 7.0.5 Fixed in 7.0.5 Patch available GHSA-4wrg-8wpc-h923
Remediation
- Fix · GHSA-4wrg-8wpc-h923 org.springframework.security:spring-security-config (Maven) Fixed in 7.0.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-22753
- 2026-10-03 Alias added: GHSA-4wrg-8wpc-h923
References
More VMware Spring Security vulnerabilities
- TI-2023-16900 Improper access control in Spring Security CVSS 3.1CRITICAL 9.8
- TI-2022-13611 Authorization bypass in Spring by VMware CVSS 3.1CRITICAL 9.8
- TI-2022-07154 Incorrect authorization in Spring Security CVSS 3.1CRITICAL 9.8
- TI-2026-42404 Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces CVSS 3.1CRITICAL 9.4
- TI-2026-18257 Under Some Conditions Spring Security HTTP Headers Are not Written CVSS 3.1CRITICAL 9.1
- TI-2014-02853 Improper authentication in Pivotal Spring Security CVSS 3.0CRITICAL 9.8
Sources
- CVE-2026-22753 · CVE Program
- CVE-2026-22753 · NVD
- FIRST EPSS
- GHSA-4wrg-8wpc-h923 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-22753 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences