Critical CVSS 9.2
CVE-2026-8338
NVD analysis in progress
A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity.
What this means
- Exposure
- Exploitable remotely over the network, without authentication and with no action from the victim. The attack does require particular conditions, which makes it less systematic. It also depends on circumstances the attacker does not control.
- Impact
- An attacker can read sensitive data, modify or destroy data and degrade the service.
- Likelihood
- Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.
What to doPatch without waiting for the next scheduled cycle. Start with the instances exposed to the internet.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.