Vulnerability Description
A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-8338?
CVE-2026-8338 is a documented vulnerability. A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted...
How severe is CVE-2026-8338?
CVSS scoring is not yet available for CVE-2026-8338. Check NVD for updates.
Is there a patch for CVE-2026-8338?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.