Skip to content
OpenAdvisories

Product · Spring

Spring Cloud Config

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.2
    CVE-2026-47836

    Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

    The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 S…

    Spring Spring Cloud Config
  • High 7.5
    CVE-2026-40981

    Spring Cloud Config has an Authorization Bypass Through User-Controlled Key

    When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclu…

    Spring Spring Cloud Config org.springframework.cloud:spring-cloud-config-server Maven
  • High 7.4
    CVE-2026-41002

    Spring Cloud Config Server Susceptible To TOCTOU Attack

    The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (incl…

    Spring Spring Cloud Config org.springframework.cloud:spring-cloud-config-server Maven