4.9
Medium
CVE-2026-47894 Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the…
Description
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Cloud Config 5.0 | 5.0.0 → 5.0.4 | No fix stated |
| Spring Cloud Config 4.3 | 4.3.0 → 4.3.4 | No fix stated |
| Spring Cloud Config 4.0 | 4.0.0 → 4.2.8 | No fix stated |
| Spring Cloud Config 3.1 | earliest → 3.1.14 | No fix stated |
References
- spring.io spring.io
Timeline
- Published
- Last modified
Other CVEs of Spring Cloud Config
The 10 CVEs of Spring Cloud Config →
CVE-2026-59315
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads
5.3
Medium
CVE-2026-47837
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to…
6.8
Medium
CVE-2026-47836
The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN…
7.2
High
CVE-2026-40981
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the…
7.5
High