Critical

Spring Cloud Config vulnerable to Path Traversal

Disclosed: 07.05.2026
Updated: 11.10.2026 12:22

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	org.springframework.cloud:spring-cloud-config-server	<= 3.1.13, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.6, >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.3	4.3.3, 5.0.3

References

CVSS score 9.1/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-22
Platform: Java / Kotlin (Maven)
Package: org.springframework.cloud:spring-cloud-config-server
Disclosed: 07.05.2026
Updated: 11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-6g23-24mc-hx6x - CC BY 4.0

Vulnerability history: org.springframework.cloud:spring-cloud-config-server

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 8
First → latest: 05.2019 05.2026
Without a fix: 0
Exploited in attacks: 1

Severity breakdown

Critical 1
High 4
Medium 3

Disclosures per year

2019: 1
2020: 2
2021: 0
2022: 0
2023: 0
2024: 0
2025: 0
2026: 5

07.05.2026

Spring Cloud Config Server Logged Sensitive Information

Medium · 4.4 CVE-2026-41004 >= 3.1.0, <= 3.1.13, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.6, >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.3, >= 3.0.0, <= 3.0.7 4.3.3, 5.0.3
07.05.2026

Spring Cloud Config Server Susceptible To TOCTOU Attack

High · 7.2 CVE-2026-41002 >= 3.1.0, <= 3.1.13, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.6, >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.3, >= 3.0.0, <= 3.0.7 4.3.3, 5.0.3
07.05.2026

Spring Cloud Config vulnerable to Path Traversal this entry

Critical · 9.1 CVE-2026-40982 <= 3.1.13, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.6, >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.3 4.3.3, 5.0.3
07.05.2026

Spring Cloud Config has an Authorization Bypass Through User-Controlled Key

High · 7.5 CVE-2026-40981 >= 3.1.0, <= 3.1.13, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.6, >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.3 4.3.3, 5.0.3
24.03.2026

Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access

High · 8.6 CVE-2026-22739 >= 4.3.0, < 4.3.2, >= 5.0.0-M1, < 5.0.2, >= 4.2.0, <= 4.2.4, >= 4.0.0, <= 4.1.7, <= 3.1.10 4.3.2, 5.0.2
05.06.2020

Directory traversal attack in Spring Cloud Config

High · 7.5 Exploited in attacks CVE-2020-5410 >= 2.1.0, < 2.1.9, >= 2.2.0, < 2.2.3 2.1.9, 2.2.3
05.06.2020

Directory traversal attack in Spring Cloud Config

Medium · 6.5 CVE-2020-5405 >= 2.1.0, < 2.1.7, >= 2.2.0, < 2.2.2 2.1.7, 2.2.2
23.05.2019

Path Traversal in Spring Cloud Config

Medium · 6.5 CVE-2019-3799 < 1.4.6, >= 2.0.0, < 2.0.4, >= 2.1.0, < 2.1.2 1.4.6, 2.0.4, 2.1.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application