4.4
Moyenne
CVE-2026-41004 When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs
Description
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Cloud Config 5.0 | 5.0.0 → < 5.0.3 | 5.0.3 |
| Spring Cloud Config 4.3 | 4.3.0 → < 4.3.3 | 4.3.3 |
| Spring Cloud Config 4.2 | 4.2.0 → < 4.2.7 | 4.2.7 |
| Spring Cloud Config 4.1 | 4.1.0 → < 4.1.10 | 4.1.10 |
| Spring Cloud Config 3.1 | 3.1.0 → < 3.1.14 | 3.1.14 |
Références
- spring.io spring.io
Chronologie
- Publiée
- Dernière modification
Autres CVE de Spring Cloud Config
Les 10 CVE de Spring Cloud Config →
CVE-2026-59315
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads
5.3
Moyenne
CVE-2026-47894
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the…
4.9
Moyenne
CVE-2026-47837
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to…
6.8
Moyenne
CVE-2026-47836
The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN…
7.2
Élevée