Spring ApplicationContext Hierarchy and a High CVE in Axelix

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Axelix users with Actuator on separate management port

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

The Brief

Axelix has a high-severity CVE involving a JWT bypass.
The bypass arose when Actuator ran on a separate management port, due to Spring's ApplicationContext hierarchy.
The source explains how the hierarchy caused the flaw.

Teams running Axelix, or Spring applications with Actuator on a separate management port, may be exposed to a JWT authentication bypass.

Checklist · 1 of 10 yes

Yes	Hits tech teams	Axelix is a Spring Boot Actuator management tool that developers and ops teams run.
No	Core infrastructure	Flaw is in Axelix, a niche Spring management tool, not shared core infrastructure.
No	Popular tool	Axelix is a niche product; the flaw is not in Spring itself.
No	Exploited in the wild	foojay.io describes a JWT bypass and high CVE; it reports no observed attacks.
No	Public exploit	foojay.io describes the bypass mechanism but does not say exploit code is published.
No	Remote, no login	foojay.io does not state the bypass works remotely without credentials.
No	Full takeover	foojay.io reports a JWT bypass but does not state code execution or admin takeover.
No	Secrets exposed	foojay.io reports no stolen credentials, tokens, keys, or data.
No	Supply chain	foojay.io describes a context hierarchy auth bypass, not compromised packages or pipelines.
No	No fix yet	foojay.io does not say whether a patched Axelix version is available.

First seen 12h ago · 1 source · Full story page · How tiers are decided