VMware Tanzu Spring Boot Actuator Vulnerabilities

CERT-Bund has released a security advisory (WID-SEC-2026-0799) concerning multiple vulnerabilities in VMware Tanzu Spring Boot Actuator. These vulnerabilities, rated with a high CVSS base score of 8.2, allow remote, anonymous attackers to bypass security controls. The advisory specifically impacts VMware Tanzu Spring Boot versions prior to 4.0.4, 3.5.12, 3.4.15, 3.3.18, and 2.7.32, affecting operating systems including UNIX and Windows.

Organizations utilizing affected versions of VMware Tanzu Spring Boot Actuator should immediately review the advisory and apply available mitigations. This includes updating to patched versions of the software to address the security bypass vulnerabilities. Failure to do so could expose systems to remote attacks, potentially leading to unauthorized access or compromise of sensitive information. The advisory indicates that mitigation is available, emphasizing the need for prompt action.