VMware Tanzu Spring Boot: Attackers can access endpoints
Important security updates close several vulnerabilities in the VMware Tanzu Spring Framework component Spring Boot.
(Image: Tatiana Popova/Shutterstock.com)
Attackers can exploit several vulnerabilities in VMware Tanzu Spring Boot, potentially leading to complete compromise of instances in the worst-case scenario. Security updates are available. Currently, there are no reports from the software manufacturer that attackers are already exploiting the vulnerabilities.
Unauthorized access possible
The developers assure that they have resolved the security issues in versions 3.5.14 and 4.0.6. They also point out that versions no longer under support are also vulnerable. In this case, administrators must upgrade to a supported version.
A total of nine vulnerabilities have been closed. As a warning message indicates, one (CVE-2026-40976) is classified as “critical.” Because authentication does not function reliably, attackers can access all endpoints.
However, for such an attack to succeed, several prerequisites listed in the warning message must be met. For example, it must be a Servlet-based web application. How such an attack could proceed in detail is currently unclear.
Further Dangers
Videos by heise
Furthermore, attackers can remotely execute malicious code (CVE-2026-40972 “high”) or cause instances to connect to malicious hosts (CVE-2026-40974 “medium”).
Admins can find more information about the closed software vulnerabilities and affected versions in the linked warning messages. List sorted by threat level in descending order:
- CVE-2026-40976: Default security filter chain has no authorization rule with Actuator but without Health
- CVE-2026-40972: DevTools remote secret comparison is vulnerable to timing attacks
- CVE-2026-40973: Predictable temp directory accepted without ownership verification
- CVE-2026-40970: Elasticsearch auto-configuration with an SSL bundle disables TLS hostname verification
- CVE-2026-40971: RabbitMQ auto-configuration with an SSL bundle disables TLS hostname verification
- CVE-2026-40974: Cassandra SSL auto-configuration disables TLS hostname verification
- CVE-2026-40975: Random value property source uses a weak PRNG unsuitable for secrets
- CVE-2026-40977: PID file write follows symlinks at predictable default path
Most recently, the developers closed several security vulnerabilities in VMware Tanzu Spring Security.
(des)
