org.springframework.cloud/spring-cloud-config-server vulnerabilities

Latest org.springframework.cloud/spring-cloud-config-server CVEs

Newest publication first

1. CVE-2026-40981 Spring Cloud Config has an Authorization Bypass Through User-Controlled Key

   Published 2026-05-07

   High·CVSS 7.5

   When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1...

2. CVE-2026-41002 Spring Cloud Config Server Susceptible To TOCTOU Attack

   Published 2026-05-07

   High·CVSS 7.4 EPSS 0.22%

   The base directory (spring.cloud.config.server.git.basedir) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1....

3. CVE-2026-41004 Spring Cloud Config Server Logged Sensitive Information

   Published 2026-05-07

   Medium·CVSS 4.4 EPSS 0.17%

   When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affe...

4. CVE-2026-40982 Spring Cloud Config vulnerable to Path Traversal

   Published 2026-05-07

   Critical·CVSS 9.1

   Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x...

5. CVE-2026-22739 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks

   Published 2026-03-24

   High·CVSS 8.6

   Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects S...

6. CVE-2020-5410 Directory traversal attack in Spring Cloud Config

   Published 2020-06-02

   High·CVSS 7.5 EPSS 95.6% CISA KEV added 2022-03-25 Exploited in the wild

   Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a spe...

7. CVE-2020-5405 Directory traversal attack in Spring Cloud Config

   Published 2020-03-05

   Medium·CVSS 6.5 EPSS 68.5%

   Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a spe...

8. CVE-2019-3799 Path Traversal in Spring Cloud Config

   Published 2019-05-06

   Medium·CVSS 6.5 EPSS 85.3% Public exploit PoC

   Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attac...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.