https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-59315.htmlhttps://patchthecve.com/cve/CVE-2026-59315.htmlMon, 31 Aug 2026 23:32:55 +0000MEDIUM 5.3: The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlierhttps://patchthecve.com/cve/CVE-2026-47894.htmlhttps://patchthecve.com/cve/CVE-2026-47894.htmlTue, 01 Sep 2026 20:37:46 +0000MEDIUM 4.9: Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlierhttps://patchthecve.com/cve/CVE-2026-47837.htmlhttps://patchthecve.com/cve/CVE-2026-47837.htmlFri, 04 Sep 2026 19:42:43 +0000MEDIUM 6.8: Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8,https://patchthecve.com/cve/CVE-2026-47836.htmlhttps://patchthecve.com/cve/CVE-2026-47836.htmlFri, 04 Sep 2026 19:44:58 +0000HIGH 7.2: The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Chttps://patchthecve.com/cve/CVE-2026-41004.htmlhttps://patchthecve.com/cve/CVE-2026-41004.htmlMon, 26 Oct 2026 19:10:00 +0000MEDIUM 4.4: When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 throhttps://patchthecve.com/cve/CVE-2026-41002.htmlhttps://patchthecve.com/cve/CVE-2026-41002.htmlMon, 26 Oct 2026 19:10:00 +0000HIGH 7.2: The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enthttps://patchthecve.com/cve/CVE-2026-40982.htmlhttps://patchthecve.com/cve/CVE-2026-40982.htmlMon, 26 Oct 2026 19:10:00 +0000CRITICAL 9.1: Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.https://patchthecve.com/cve/CVE-2026-40981.htmlhttps://patchthecve.com/cve/CVE-2026-40981.htmlMon, 26 Oct 2026 19:10:00 +0000HIGH 7.5: When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Ente