Sonar-security-java-frontend-plugin-10.11.1.35426.jar vulnerable to CVE-2026-40478

SonarQube Server / Community Build
,
1

The library org.thymeleaf:thymeleaf version 3.1.3 was detected in Maven library manager located at /[Partition=996039c6]/data/web/deploy/plugins/securityjavafrontend/sonar-security-java-frontend-plugin-10.11.1.35426.jar -> META-INF/lib/thymeleaf-3.1.3.RELEASE.jar
is vulnerable to CVE-2026-40478.

Wiz.io had detected this, and our current setup is pointing towards 2025.1.4 Sonar with postgres 17.9.

We are trying to upgrade to sonar 2026.2.1 in order to fix the issue but i do see the jar in this version still hosts thymeleaf version 3.1.3

Can you please confirm if the upgrade will sort this issue or do we need to wait for a patch from sonarqube community? if yes then,

Is there any hot patch available for this we can apply on our pod hosting this service in the meantime?

3

Hi,

I’ve unlisted your topic since you’re reporting a vulnerability. Our responsible disclosure policy asks that you email security@sonarsource.com rather than making public posts. Could you please re-send this to security@sonarsource.com?

 
Thx,
Ann