Spring Security CVE-2026-22754: Brief Summary of an XML Authorization Bypass in the 7.0.x Line

Introduction

One line of code that silently discards a return value leaves Spring Security's XML authorization rules completely inert. CVE-2026-22754, scored at CVSS 7.5, affects Spring Security 7.0.0 through 7.0.4. It lets unauthenticated attackers bypass endpoint authorization when applications rely on XML sec:intercept-url directives with a servlet-path attribute.

If your organization runs Spring Security 7.0.x with XML-based security configuration, an endpoint that looks properly secured may be wide open to any network request.

Technical Information

Root Cause: Immutable Builder Misuse

The bug is in the PathPatternRequestMatcherFactoryBean class, which builds request matchers when XML-based <sec:intercept-url> elements specify a servlet-path attribute. The basePath() method on the internal builder follows an immutable design. Calling it returns a new builder instance configured with the supplied base path and leaves the existing builder unchanged.

The vulnerable code called this method but discarded the return value:

// BEFORE (vulnerable) — in PathPatternRequestMatcherFactoryBean.java:
if (this.basePath != null) {
    this.builder.basePath(this.basePath);  // return value silently discarded!
}

The new builder, the one with the servlet path correctly set, was never stored, so the original this.builder kept running with no base path. Every URL pattern evaluated through XML intercept-url rules left out the configured servlet path, and the authorization constraints attached to those rules never matched incoming requests.

Attack Flow

Consider an application that defines the following XML security rule:

<sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**" />

Spring Security is supposed to compose the full path (/servlet-path/endpoint/**) when it evaluates authorization decisions. Because the builder return value was discarded, the framework evaluates against /endpoint/** alone, with no servlet path prefix. The real request, routed through the servlet at /servlet-path/endpoint/resource, does not match that incomplete pattern, so the authorization rule never runs.

An attacker exploiting this flaw would:

1. Identify an application using Spring Security 7.0.0 through 7.0.4 with XML-based intercept-url rules that specify a servlet-path attribute.
2. Send unauthenticated HTTP requests directly to the protected endpoints through the servlet path.
3. Let the requests pass through with no access control checks, because the authorization rules never match.

Exploitation needs no user interaction and no prior authentication, and the attack complexity is low. These factors contribute to the CVSS 7.5 rating, which also reflects high integrity impact.

Patch Information

The Spring Security team fixed CVE-2026-22754 with a one-line change. Josh Cummings (jzheaux) committed it on April 15, 2026, in commit 53bcf0d. The fix shipped in Spring Security 7.0.5 (released April 20, 2026) and is also included in 7.1.0-RC1.

The fix is a single-character reassignment that captures the returned builder:

// AFTER (patched):
if (this.basePath != null) {
    this.builder = this.builder.basePath(this.basePath);  // reassign!
}

With the new builder stored back in this.builder, every request matcher built afterward includes the servlet path, and XML rules compose the full path (/servlet-path/endpoint/**) when evaluating authorization decisions.

The commit also adds 72 lines of test code to InterceptUrlConfigTests.java. The new tests cover servlet path authorization in both the legacy AccessDecisionManager code path and the newer AuthorizationManager one. They explicitly assert that requests to the combined servlet path and endpoint pattern are denied, and that requests outside the servlet path prefix pass through as expected.

The fix shipped in a coordinated security release that also addressed six other CVEs (CVE-2026-22746 through CVE-2026-22753). The corresponding Spring Boot hotfix versions are 3.4.15.2 and 3.3.18.2.

Temporary Workaround: If you cannot upgrade immediately, the vendor recommends putting the servlet path directly in the URL pattern string instead of using the dedicated servlet-path attribute. This avoids the broken code path entirely.

Affected Systems and Versions

The vulnerability affects applications that use XML-based <sec:intercept-url> directives with the servlet-path attribute. Applications configured through the Java DSL are not affected by this CVE, though a related issue, CVE-2026-22753, covers the analogous flaw in HttpSecurity Java DSL configuration.

Spring Boot versions 3.4.15.2 and 3.3.18.2 include the patched Spring Security dependency.

Vendor Security History

The April 21, 2026 coordinated release addressed seven CVEs across Spring Security 7.0.x, which points to a concentrated effort to harden the new major version.

CVE-2026-22753 and CVE-2026-22754 are the same class of bug, servlet path omission, showing up in both the XML and Java DSL configuration paths. That suggests the immutable builder pattern was consistently misused at multiple integration points in the 7.0.x line.

References

• Spring Security Advisory: CVE-2026-22754
• NVD Entry: CVE-2026-22754
• CVE Record: CVE-2026-22754
• Spring Security 2026.04 Releases Blog Post
• Fix Commit 53bcf0d by jzheaux
• Spring Security 7.0.5 Release Tag
• Spring Security Project Page
• 7 Critical Vulnerabilities Threaten Spring Security 7.0 (SecurityOnline)