CVE-2026-40982
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A directory traversal vulnerability in Spring Cloud Config allows attackers to access arbitrary files via a crafted URL. The issue affects the spring-cloud-config-server module serving text and binary files.
Risk Assessment
An attacker can read files outside the intended directory, potentially exposing sensitive configuration data or source code, leading to further compromise.
Recommendation
Upgrade Spring Cloud Config to version 3.1.14, 4.1.10, 4.2.7, 4.3.3, or 5.0.3 depending on your branch. Enterprise Support Only versions require a commercial subscription.
Other vulnerabilities in Spring Cloud Config
See all- CVE-2020-5410HighActively exploited
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
- CVE-2026-59315Medium
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Affects Spring Cloud Config versions 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, and 3.1.14 and earlier.
- CVE-2026-47894Medium
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Affected versions: Spring Cloud Config 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, and 3.1.14 and earlier.
- CVE-2026-47837Medium
Missing Authentication for Critical Function vulnerability in Spring Cloud Config allows unvalidated Webhook requests to the /monitor endpoint. Affects versions from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.
- CVE-2026-47836High
The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Affected versions: Spring Cloud Config 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, 3.1.14 and earlier.
- CVE-2026-40981High
A vulnerability in Spring Cloud Config allows a client to craft a request to the config server, potentially exposing secrets from unintended GCP projects when Google Secrets Manager is used as a backend.
Original NVD description (English source)
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS