Spring Security/Actuator/SCG/Thymeleaf vulnerabilities & hardening
Key Questions
What is the 9.1 CVSS flaw affecting Spring Boot apps?
The 9.1 CVSS actuator auth bypass and DevTools RCE in Boot 4.0.6/3.5.14 expose millions of apps. Fixes also cover temp dir hijacks and enterprise vulnerabilities.
What vulnerabilities were fixed in Spring Framework 7.0.7?
Framework 7.0.7/6.2.18 patches MVC/WebFlux DoS, March CVE-2026-22732 bypasses, SCG CVE-2026-22750, Spring AI RCE, and Thymeleaf CVE-2026-40478 SSTI.
How does Thymeleaf CVE-2026-40478 impact applications?
Thymeleaf 3.1.4.RELEASE fixes a 9.1 CVSS sandbox bypass enabling SSTI RCE in the popular Java template engine.
What are best practices for actuator and OTel exfiltration prevention?
Use SigNoz/declarative YAML for actuator/OTel, resilience4j circuits, JWT/OAuth2. Implement logging/SRE, Boot4 audits/CI, and Bean Validation/SCG patterns.
How to implement API Gateway patterns securely with Spring Cloud?
Spring Cloud Gateway provides robust microservices API Gateway with flexible routing, security, and resilience features.
Continue prioritizing patches and production audits for previously tracked Boot, Framework, Spring Cloud Gateway, Spring AI, and Thymeleaf vulnerabilities; secure Actuator and review authentication and authorization boundaries. The Basic Authentication REST guide is a low-detail reference, not evidence of a new vulnerability or urgent change.