Spring Spring Cloud Config vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20251
3. 20268

Newest CVEs

• CVE-2026-59315

  Spring Cloud Config Monitor Denial of Service

  Spring · Spring Cloud Config

  Medium5.3
• CVE-2026-47894

  Spring Cloud Config Server Native Environment Repository Exposure

  Spring · Spring Cloud Config

  Medium4.9
• CVE-2026-47837

  Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

  Spring · Spring Cloud Config

  Medium6.8
• CVE-2026-47836

  Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

  Spring · Spring Cloud Config

  High7.2
• CVE-2026-40981

  When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing…

  Spring · Spring Cloud Config

  High7.5
• CVE-2026-41002

  The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to…

  Spring · Spring Cloud Config

  High7.4
• CVE-2026-41004

  When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from…

  Spring · Spring Cloud Config

  Medium4.4
• CVE-2026-40982

  Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker,…

  Spring · Spring Cloud Config

  Critical9.1
• CVE-2025-22232

  Spring Cloud Config Server May Not Use Vault Token Sent By Clients

  Spring · Spring Cloud Config

  Medium5.3
• CVE-2019-3799

  Directory Traversal with spring-cloud-config-server

  Spring · Spring Cloud Config

  Medium6.5