CVE-2026-40982 Spring Cloud Config allows applications to serve arbitrary text and binary files through the…
Description
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Cloud Config 5.0 | 5.0.0 → < 5.0.3 | 5.0.3 |
| Spring Cloud Config 4.3 | 4.3.0 → < 4.3.3 | 4.3.3 |
| Spring Cloud Config 4.2 | 4.2.0 → < 4.2.7 | 4.2.7 |
| Spring Cloud Config 4.1 | 4.1.0 → < 4.1.10 | 4.1.10 |
| Spring Cloud Config 3.1 | 3.1.0 → < 3.1.14 | 3.1.14 |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published |