CVE-2026-59315
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Affects Spring Cloud Config versions 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, and 3.1.14 and earlier.
Risk Assessment
An attacker can send malicious requests that overload the server, causing unavailability of configuration services. This may disrupt all applications relying on configuration.
Recommendation
It is recommended to upgrade Spring Cloud Config to the latest patched version. Also restrict access to the config monitor and implement overload protection mechanisms.
Other vulnerabilities in Spring Cloud Config
See all- CVE-2026-40982Critical
A directory traversal vulnerability in Spring Cloud Config allows attackers to access arbitrary files via a crafted URL. The issue affects the spring-cloud-config-server module serving text and binary files.
- CVE-2020-5410HighActively exploited
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
- CVE-2026-47894Medium
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Affected versions: Spring Cloud Config 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, and 3.1.14 and earlier.
- CVE-2026-47837Medium
Missing Authentication for Critical Function vulnerability in Spring Cloud Config allows unvalidated Webhook requests to the /monitor endpoint. Affects versions from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.
- CVE-2026-47836High
The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Affected versions: Spring Cloud Config 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, 3.1.14 and earlier.
- CVE-2026-40981High
A vulnerability in Spring Cloud Config allows a client to craft a request to the config server, potentially exposing secrets from unintended GCP projects when Google Secrets Manager is used as a backend.
Original NVD description (English source)
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier
Vulnerability data from NVD (NIST) · CISA KEV · EPSS