Product by Spring
Spring Cloud Config
10 known vulnerabilities in Spring Cloud Config (Spring), 0 of them actively exploited (CISA KEV).
Key figures
10
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2019-3799 | Directory Traversal with spring-cloud-config-server | 6.5 | |
| Critical | CVE-2026-40982 | Spring Cloud Config: Path Traversal | 9.1 | |
| Critical | CVE-2026-47837 | Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests | 6.8 | |
| High | CVE-2026-40981 | Spring Cloud Config: Authorization Bypass Through User-Controlled Key | 7.5 | |
| High | CVE-2026-47894 | Spring Cloud Config Server Native Environment Repository Exposure | 4.9 | |
| High | CVE-2026-47836 | Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN | 7.2 | |
| Medium | CVE-2026-59315 | Spring Cloud Config Monitor Denial of Service | 5.3 | |
| High | CVE-2026-41002 | Spring Cloud Config: Time-of-check Time-of-use (TOCTOU) Race Condition | 8.1 | |
| Medium | CVE-2025-22232 | Spring Cloud Config Server May Not Use Vault Token Sent By Clients | 5.3 | |
| Medium | CVE-2026-41004 | Spring Cloud Config: Insertion of Sensitive Information into Log File | 4.4 |