PatchTheCVEspring cloud config vulnerabilities and fixes
Recent CVEs affecting spring cloud config, with upgrade or downgrade steps. 8 tracked.
Also searched as: springcloudconfig.
spring cloud config has 8 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 8. Most recent: 2026-08-27. Highest priority: CVE-2026-40982 (score 50/100).
- CVE-2026-40982 CRITICAL 9.1 UPGRADE Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-conf
- CVE-2026-40981 HIGH 7.5 UPGRADE When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request
- CVE-2026-41002 HIGH 7.2 UPGRADE The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone
- CVE-2026-41004 MEDIUM 4.4 UPGRADE When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in th
- CVE-2026-47836 HIGH 7.2 UPGRADE The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SV
- CVE-2026-47837 MEDIUM 6.8 UPGRADE Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook reques
- CVE-2026-47894 MEDIUM 4.9 UPGRADE Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the
- CVE-2026-59315 MEDIUM 5.3 UPGRADE The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Clo
FAQ
How do I fix spring cloud config vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is spring cloud config being exploited right now?
None of the tracked spring cloud config CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which spring cloud config CVE should I patch first?
CVE-2026-40982 currently ranks highest (50/100): Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-conf.