Vulnerability · Published May 7, 2026 · Assigned by vmware
CVE-2026-40982
Critical 9.1
In plain English
A critical-severity path traversal in Spring Cloud Config from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-6g23-24mc-hx6x |
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-6g23-24mc-hx6x |
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-6g23-24mc-hx6x |
| Maven | org.springframework.cloud:spring-cloud-config-server | 4.3.3 | GHSA-6g23-24mc-hx6x |
| Maven | org.springframework.cloud:spring-cloud-config-server | 5.0.3 | GHSA-6g23-24mc-hx6x |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Cloud Config | 3.1.0 – before 3.1.144.1.0 – before 4.1.104.2.0 – before 4.2.74.3.0 – before 4.3.35.0.0 – before 5.0.3 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://spring.io/security/cve-2026-40982
- https://access.redhat.com/security/cve/CVE-2026-40982 vdb-entry, x_refsource_REDHAT
- RHBZ#2467619 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40982.json x_sadp-csaf-vex