Spring Cloud Config (Vmware) - vulnerabilities (CVEs)
13 CVEs, 0 in the last 30 days, 182 known versions, newest CVE from 2026-08-27. Vendor: Vmware.
CVEs of Spring Cloud Config
- CVE-2026-59315 - CVSS 5.3 (medium), 2026-08-27: The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config…
- CVE-2026-47894 - CVSS 7.5 (high), 2026-08-27: Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config…
- CVE-2026-47837 - CVSS 9.8 (critical), 2026-08-26: Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor…
- CVE-2026-47836 - CVSS 8.1 (high), 2026-08-26: The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to…
- CVE-2026-41004 - CVSS 4.4 (medium), 2026-05-07: When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from…
- CVE-2026-41002 - CVSS 8.1 (high), 2026-05-07: The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to…
- CVE-2026-40982 - CVSS 9.1 (critical), 2026-05-07: Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker,…
- CVE-2026-40981 - CVSS 7.5 (high), 2026-05-07: When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing…
- CVE-2026-22739 - CVSS 8.6 (high), 2026-03-24: Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file…
- CVE-2023-20859 - CVSS 5.5 (medium), 2023-03-23: In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive…
- CVE-2020-5410 - CVSS 7.5 (high), 2020-06-02: Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary…
- CVE-2020-5405 - CVSS 6.5 (medium), 2020-03-05: Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary…
- CVE-2019-3799 - CVSS 6.5 (medium), 2019-05-06: Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow…
