Spring Spring Cloud Config
10 CVEs affecting Spring Spring Cloud Config. Latest disclosed: 2026-08-27. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40982 | Critical | 9.1 | 2026-05-07 | Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker… |
CVE-2026-40981 | High | 7.5 | 2026-05-07 | When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secret… |
CVE-2026-47836 | High | 7.2 | 2026-08-26 | The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check… |
CVE-2026-41002 | High | 7.2 | 2026-05-07 | The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-che… |
CVE-2026-47837 | Medium | 6.8 | 2026-08-26 | Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpo… |
CVE-2019-3799 | Medium | 6.5 | 2019-05-06 | Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow appl… |
CVE-2026-59315 | Medium | 5.3 | 2026-08-27 | The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0… |
CVE-2025-22232 | Medium | 5.3 | 2025-04-10 | Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affecte… |
CVE-2026-47894 | Medium | 4.9 | 2026-08-27 | Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config… |
CVE-2026-41004 | Medium | 4.4 | 2026-05-07 | When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from… |