What is GHSA-f3gv-992v-c3v5?

GHSA-f3gv-992v-c3v5 is a security advisory published by GitHub Security Advisories with Critical severity. A Spring Security authentication and authorization bypass exists in Coverity Connect versions...

Which CVE IDs does GHSA-f3gv-992v-c3v5 cover?

GHSA-f3gv-992v-c3v5 covers the following CVE IDs: CVE-2026-8338. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-f3gv-992v-c3v5Critical

A Spring Security authentication and authorization bypass exists in Coverity Connect versions...

Vendor

GitHub Security Advisories

Published

July 29, 2026

Last Modified

July 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-8338 →

📋 Description

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-8338
https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2026-8338-Authentication-and-Authorization-Bypass
https://github.com/advisories/GHSA-f3gv-992v-c3v5