CVE-2026-8338 Authentication and Authorization Bypass in Coverity Connect
An unauthenticated attacker can bypass authentication and authorization controls to access sensitive data via specially crafted HTTP requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8338?
CVE-2026-8338 is a critical authentication bypass vulnerability in Black Duck Coverity Connect, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity.
Weakness: CWE-288
Which versions are affected by CVE-2026-8338?
How do I fix CVE-2026-8338?
No fix has been published for CVE-2026-8338 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-8338 being exploited?
There is no known exploitation of CVE-2026-8338 in the wild and no public exploit code.
Sources
Also known as GHSA-f3gv-992v-c3v5.