Spring Spring Cloud Config vulnerabilities
10 published CVEs name Spring Spring Cloud Config among the affected products.
- 10Published CVEs10 of them scored
- 8Last 12 monthspublished in the last year
- 1Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-59315
Spring Cloud Config Monitor Denial of Service
Spring · Spring Cloud Config
Medium5.3 - CVE-2026-47894
Spring Cloud Config Server Native Environment Repository Exposure
Spring · Spring Cloud Config
Medium4.9 - CVE-2026-47837
Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
Spring · Spring Cloud Config
Medium6.8 - CVE-2026-47836
Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
Spring · Spring Cloud Config
High7.2 - CVE-2026-40981
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing…
Spring · Spring Cloud Config
High7.5 - CVE-2026-41002
The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to…
Spring · Spring Cloud Config
High7.4 - CVE-2026-41004
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from…
Spring · Spring Cloud Config
Medium4.4 - CVE-2026-40982
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker,…
Spring · Spring Cloud Config
Critical9.1 - CVE-2025-22232
Spring Cloud Config Server May Not Use Vault Token Sent By Clients
Spring · Spring Cloud Config
Medium5.3 - CVE-2019-3799
Directory Traversal with spring-cloud-config-server
Spring · Spring Cloud Config
Medium6.5