Skip to content
OpenAdvisories

Product · Spring

Spring Cloud Config

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-59315

    Spring Cloud Config Monitor Denial of Service

    The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

    Spring Spring Cloud Config
  • Medium 4.9
    CVE-2026-47894

    Spring Cloud Config Server Native Environment Repository Exposure

    Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Confi…

    Spring Spring Cloud Config
  • Medium 6.8
    CVE-2026-47837

    Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

    Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 …

    Spring Spring Cloud Config
  • Medium 4.4
    CVE-2026-41004

    Spring Cloud Config Server Logged Sensitive Information

    When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Clo…

    Spring Spring Cloud Config org.springframework.cloud:spring-cloud-config-server Maven
  • Medium 5.3
    CVE-2025-22232

    Spring Cloud Config Server May Not Use Vault Token Sent By Clients

    Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: * You have Spring Vault on the classpath of your Spring Cloud C…

    Spring Spring Cloud Config
  • Medium 6.5
    CVE-2019-3799 Public exploit EPSS 85%

    Directory Traversal with spring-cloud-config-server

    Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A mal…

    Spring Spring Cloud Config org.springframework.cloud:spring-cloud-config-server Maven