CVE-2026-8338

Critical

Description

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity.

SeverityCritical

CVSS9.2

Exploit probability—

ProductCoverity Connect

PublishedJul 29, 2026

First seenJul 29, 2026

Weakness typeCWE-288CWE-288

How to fix

Update

Black Duck Coverity Connect2026.6.0 or later

Vendor advisories

community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2026-8338-Authentication-and-Authorization-Bypass

Affected products

Product	Affected versions	Fixed in
Black Duck Coverity Connect	2023.6.0 ≤ v < 2026.6.0	2026.6.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.