CVE-2026-22747
Improper Certificate Validation in Spring Security Enables User Impersonation
Publication date: 2026-04-22
Last updated on: 2026-04-24
Assigner: VMware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vmware | spring_security | From 7.0.0 (inc) to 7.0.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-297 | The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22747 is a medium-severity vulnerability in Spring Security versions 7.0.0 through 7.0.4. It involves the SubjectX500PrincipalExtractor component, which incorrectly processes certain malformed X.509 certificate Common Name (CN) values. This flaw can cause the system to read an incorrect username from a certificate.
An attacker who crafts a specially malformed X.509 client certificate can exploit this vulnerability to impersonate another user by making the system believe the attacker is someone else.
This vulnerability exists in the pre-authentication flow of Spring Security, which assumes credentials have already been validated by a trusted upstream system. Exploitation requires compromising that upstream trust, making this primarily a defense-in-depth concern.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to impersonate another user by exploiting the incorrect handling of malformed X.509 certificate CN values. This can lead to unauthorized access to sensitive information or systems under the guise of a legitimate user.
Because the vulnerability affects the confidentiality and integrity of user authentication, it can compromise the security of applications relying on Spring Security for authentication.
However, exploitation requires that the attacker can supply a specially crafted certificate and that the upstream trust system is compromised, which means the attack complexity is high and privileges required are low.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the SubjectX500PrincipalExtractor component in Spring Security versions 7.0.0 through 7.0.4 improperly handling malformed X.509 certificate Common Name (CN) values. Detection would involve identifying if your system is running an affected version of Spring Security and if malformed X.509 client certificates are being accepted.
Since the vulnerability is related to certificate handling within Spring Security, detection on the network or system level would require inspecting the versions of Spring Security in use and monitoring for unusual or malformed X.509 client certificates.
There are no specific commands provided in the available resources to detect this vulnerability directly.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade Spring Security to version 7.0.5 or later, where the vulnerability in the SubjectX500PrincipalExtractor component has been fixed.
Since exploitation requires a compromised upstream trust system, ensuring that the upstream certificate validation and trust mechanisms are secure is also important as a defense-in-depth measure.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker to impersonate another user by exploiting malformed X.509 certificates, potentially leading to unauthorized access to sensitive information.
Such unauthorized access can impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls on user authentication and protection of personal and sensitive data.
Because the vulnerability affects the integrity and confidentiality of user identity verification, it may increase the risk of data breaches or unauthorized data access, thereby complicating adherence to these regulations.
However, exploitation requires compromise of the upstream trust system, making this primarily a defense-in-depth concern rather than a direct standalone attack vector.