CVE-2026-8338

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in Coverity Connect

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Synopsys

Description

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-8338

Affected Vendors & Products

Vendor	Product	Version / Range
synopsys	coverity_connect	From 2023.6.0 (inc) to 2026.3.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

This vulnerability is an authentication and authorization bypass in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated attacker can send a specially crafted HTTP request to bypass security controls on certain API endpoints and access data without proper authorization.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized access to Coverity Connect API endpoints. Monitor HTTP logs for unusual requests to endpoints like /api/v2/ or /api/v1/ in Coverity Connect versions 2023.6.0 to 2026.3.0. Look for requests without valid authentication headers or unexpected source IPs.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data stored in Coverity Connect, potentially leading to data theft, unauthorized modifications, or further network compromise depending on the exposed data and system configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations that mandate strict access controls and data protection measures.

Mitigation Strategies

Immediately upgrade Coverity Connect to a version outside the vulnerable range (2023.6.0 to 2026.3.0). If upgrading is not possible, restrict network access to Coverity Connect API endpoints via firewall rules and disable unnecessary API endpoints. Review logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-8338. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70