Spring Cloud Config
Approved changes feed: RSS · Atom
cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Vmware (7bb62c7c-2241-5a0b-8dbc-5f13251fb24e) |
|---|---|
| Product | Spring Cloud Config (5d78fabd-575b-5155-936a-c58e0bf392be) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/spring-cloud/spring-cloud-config |
purl2cpe | 2026-06-01 10:12:21.845767 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-41004 |
vulnerable | 2026-06-08 08:03:14.542078 |
Details available
MEDIUM (4.4)
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Published: 2026-05-07T03:51:31.920Z
Updated: 2026-05-07T12:56:31.413Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41002 |
vulnerable | 2026-06-08 08:03:14.541543 |
Details available
HIGH (7.4)
The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Published: 2026-05-07T03:53:18.269Z
Updated: 2026-05-09T03:55:58.649Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40982 |
vulnerable | 2026-06-08 08:03:14.538331 |
Details available
CRITICAL (9.1)
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Published: 2026-05-07T03:49:30.065Z
Updated: 2026-07-15T01:00:13.424Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40981 |
vulnerable | 2026-06-08 08:03:14.537919 |
Details available
HIGH (7.5)
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Published: 2026-05-07T03:55:43.600Z
Updated: 2026-07-15T01:00:15.193Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-20859 |
vulnerable | 2026-06-08 05:54:17.952306 |
Details available
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
Published: 2023-03-23T00:00:00.000Z
Updated: 2025-02-25T15:40:28.087Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5410 |
vulnerable | 2026-06-08 05:26:42.796202 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5405 |
vulnerable | 2026-06-08 05:26:42.787190 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-3799 |
vulnerable | 2026-06-08 05:13:56.011837 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.