// wall of bugs caught
15 critical bugs
PullLight would have caught in your PRs.
Every card below is a real bug flagged during PR review — CVEs, CWEs, before/after code. No competitors have a page like this. Try it on your own PR →
19
Total catches
15
Critical
4
High
15
CVSS ≥ 9
6
Languages
high
# auth-bypass
Java
CVE-2026-22731
Authentication Bypass under Actuator Health Groups Paths
Spring Boot maps custom health groups to additional server paths (e.g. server:/healthz) but actuator path mapping can bypass authentication on subpaths like /healthz/admin — allowing admin access without credentials.
Before / after code snippet
Before (vulnerable)
# BEFORE (vulnerable) # application.properties spring.boot.admin.context-path=/admin management.endpoints.web.base-path=/healthz # Custom health group mapped to /healthz endpoint — auth bypass on /healthz/admin # All subpaths of /healthz become unauthenticated
After (fixed)
# AFTER (fixed)
# Option 1: Don't nest auth-required endpoints under actuator paths
# Option 2: Add explicit Spring Security rules:
# security.filter顺序 = actuator before security
# Option 3: Map health group to isolated path not under actuator base
management.endpoints.web.base-path=/actuator
# Or apply @PreAuthorize("isAuthenticated()") to admin endpoints