Actively exploited in the wild
VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
VMware Tanzu - Spring Cloud Configuration (Config) Server · Listed in the CISA KEV since 2022-03-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-5410
HighCVSS 7.5KEVSummary
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Risk Assessment
An attacker can access files outside the intended directory, including configuration files containing sensitive data such as passwords or API keys, potentially leading to further attacks.
Recommendation
Update Spring Cloud Config to version 2.2.3 or 2.1.9 (or later) depending on the branch in use to address the vulnerability.
Other vulnerabilities in Spring Cloud Config
See all- CVE-2026-40982Critical
A directory traversal vulnerability in Spring Cloud Config allows attackers to access arbitrary files via a crafted URL. The issue affects the spring-cloud-config-server module serving text and binary files.
- CVE-2026-59315Medium
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Affects Spring Cloud Config versions 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, and 3.1.14 and earlier.
- CVE-2026-47894Medium
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Affected versions: Spring Cloud Config 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, and 3.1.14 and earlier.
- CVE-2026-47837Medium
Missing Authentication for Critical Function vulnerability in Spring Cloud Config allows unvalidated Webhook requests to the /monitor endpoint. Affects versions from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.
- CVE-2026-47836High
The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Affected versions: Spring Cloud Config 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, 3.1.14 and earlier.
- CVE-2026-40981High
A vulnerability in Spring Cloud Config allows a client to craft a request to the config server, potentially exposing secrets from unintended GCP projects when Google Secrets Manager is used as a backend.
Original NVD description (English source)
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.