Skip to content
OpenAdvisories
Medium WID-SEC-2026-2952 17 CVEs

VMware Tanzu Spring Cloud: Mehrere Schwachstellen

Published Aug 20, 2026 · Updated Aug 27, 2026 · Revision 3 · de-DE

Vendor: VMware Tanzu Product: Spring Cloud Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Cloud ausnutzen, um Dateien zu manipulieren, um Informationen offenzulegen und um Sicherheitsvorkehrungen zu umgehen.

Product

VMware Tanzu Spring Cloud ist eine Plattform zur Bereitstellung und Verwaltung von Spring-Anwendungen in Cloud-Umgebungen unter Verwendung von Microservices-Architekturen.

Vulnerabilities 17

  • High 7.7
    CVE-2026-47879

    Spring Cloud Gateway SSRF and native file access with gRPC

    Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1…

    Spring Spring Cloud Gateway
  • High 7.2
    CVE-2026-47836

    Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

    The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 S…

    Spring Spring Cloud Config
  • Medium 6.8
    CVE-2026-47837

    Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

    Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 …

    Spring Spring Cloud Config
  • Medium 6.6
    CVE-2026-59284

    Spring Cloud Commons no allow list for writable env actuator endpoint

    There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier

    Spring Spring Cloud Commons
  • Medium 5.3
    CVE-2026-59315

    Spring Cloud Config Monitor Denial of Service

    The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

    Spring Spring Cloud Config
  • Medium 4.9
    CVE-2026-47894

    Spring Cloud Config Server Native Environment Repository Exposure

    Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Confi…

    Spring Spring Cloud Config
  • Low 3.1
    CVE-2026-59297

    Spring Cloud Function can incorrectly determine if URI is secure

    Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

    Spring Spring Cloud Function
  • Low 3.1
    CVE-2026-59298

    Potential for improper filtering of HTTP headers in Spring Cloud Function

    Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

    Spring Spring Cloud Function
  • Low 3.1
    CVE-2026-59299

    Composition lookup can potentially poison base function in Spring Cloud Function

    Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

    Spring Spring Cloud Function
  • Low 3.1
    CVE-2026-59300

    Potential for logging sensitive data in Spring Cloud Function AWS

    Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

    Spring Spring Cloud Function
  • Low 3.1
    CVE-2026-59301

    Potential for logging sensitive data in Spring Cloud Function Azure

    Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

    Spring Spring Cloud Function
  • Low 3.1
    CVE-2026-59302

    Potential for logging sensitive data in Spring Cloud Stream

    Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

    Spring Spring Cloud Stream
  • Low 3.1
    CVE-2026-59303

    Dynamic destination cache size is not properly bound in Spring Cloud Stream

    Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

    Spring Spring Cloud Stream
  • Low 3.1
    CVE-2026-59304

    Improper caching of the original content type in Spring Cloud Stream Avro

    Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

    Spring Spring Cloud Stream
  • Low 3.1
    CVE-2026-59305

    Partition interceptor may be improperly added while sending message

    Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

    Spring Spring Cloud Stream
  • Low 3.1
    CVE-2026-59306

    Potential for deserialization of untrusted types in Spring Cloud Stream

    Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

    Spring Spring Cloud Stream
  • Low 2.0
    CVE-2026-59291

    Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function

    Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

    Spring Spring Cloud Function

Revision history

  1. #3

    CVE-Nummern ergänzt

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-66638, EUVD-2026-66637

  3. #1

    Initiale Fassung

References