CRITICAL 9.2 NVD

CVE-2026-8338

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity.

References

https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2026-83

Published: 2026-07-29 · Source: NVD · Feed updated: 2026-08-04

This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-07-29 via NVD.

Risk Timeline

CVE Disclosed2026-07-29 · 5 days ago

Remediation Resources

Official Advisory

community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory

vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.