Spring Cloud Config vulnerabilities
7 known CVE vulnerabilities in Spring Cloud Config, translated and rated.
- CVE-2026-40982Critical
A directory traversal vulnerability in Spring Cloud Config allows attackers to access arbitrary files via a crafted URL. The issue affects the spring-cloud-config-server module serving text and binary files.
- CVE-2020-5410HighActively exploited
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
- CVE-2026-59315Medium
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Affects Spring Cloud Config versions 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, and 3.1.14 and earlier.
- CVE-2026-47894Medium
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Affected versions: Spring Cloud Config 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, and 3.1.14 and earlier.
- CVE-2026-47837Medium
Missing Authentication for Critical Function vulnerability in Spring Cloud Config allows unvalidated Webhook requests to the /monitor endpoint. Affects versions from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.
- CVE-2026-47836High
The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Affected versions: Spring Cloud Config 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, 3.1.14 and earlier.
- CVE-2026-40981High
A vulnerability in Spring Cloud Config allows a client to craft a request to the config server, potentially exposing secrets from unintended GCP projects when Google Secrets Manager is used as a backend.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS