Vulnerability · Published May 7, 2026 · Assigned by vmware
CVE-2026-41004
Medium 4.4
In plain English
A medium-severity sensitive data in logs in Spring Cloud Config from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-j6hh-h3cf-c2hf |
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-j6hh-h3cf-c2hf |
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-j6hh-h3cf-c2hf |
| Maven | org.springframework.cloud:spring-cloud-config-server | 4.3.3 | GHSA-j6hh-h3cf-c2hf |
| Maven | org.springframework.cloud:spring-cloud-config-server | 5.0.3 | GHSA-j6hh-h3cf-c2hf |
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-j6hh-h3cf-c2hf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Cloud Config | 3.1.0 – before 3.1.144.1.0 – before 4.1.104.2.0 – before 4.2.74.3.0 – before 4.3.35.0.0 – before 5.0.3 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N