com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2.2.7.release, <=2.2.8.release), com.buession.springcloud:buession-springcloud-config-server (>=1.3.0, <=2.3.3) +19 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.8.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

io.mosip.kernel:kernel-config-server (>=1.2.1-rc1, <=1.3.1), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=7.0.0, <=7.1.6.2) +5 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=4.1.0, <=4.1.7)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.1.0, =1.2.1-rc1, =7.0.0, =7.0.0, =4.1.0, =3.1.0, =3.1.6 Source cves: CVE-2026-40982 Source advisory: OSV:GHSA-6G23-24MC-HX6X...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +6 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.2.0, =0.0.1, =1.0.0, =3.0.9, =0.1.41-beta, =7.2.0-rc3, =7.2.0-rc3, =4.2.0, =3.2.0, =3.2.3 Source cves: CVE-2026-40982 Source advisory: OSV:GHSA-6G23-24MC-HX6X...

net.smartcosmos:smartcosmos-config-server (3.0.1), org.apereo.cas:cas-management-webapp-support (5.0.0.m3) +83 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.1.2.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - net.smartcosmos:smartcosmos-config-server 3.0.1...

GHSA-6G23-24MC-HX6X Spring Cloud Config vulnerable to Path Traversal

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from...

org.apereo.cas:cas-management-webapp (>=5.0.0.rc3, <=5.0.1), org.apereo.cas:cas-management-webapp-support (>=5.0.0.rc3, <=5.0.1) +103 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.2.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - org.apereo.cas:cas-management-webapp =5.0.0.rc3...

io.openexchange:configserver (1.0.3), org.apereo.cas:cas-management-webapp (>=5.0.2, <=5.0.10) +106 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.2.2.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - io.openexchange:configserver 1.0.3 -...

com.ecfront.dew:config (>=1.0.0, <=1.1.1), org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.1.0-rc4, <=5.1.9) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.3.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - com.ecfront.dew:config =1.0.0, =5.1.0-rc4,...

com.ecfront.dew:config (>=1.1.2, <=1.1.4), org.apereo.cas:cas-server-core-configuration-cloud-amqp (5.2.0-rc1) +11 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.3.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - com.ecfront.dew:config =1.1.2, =1.0.0.release,...

io.choerodon:choerodon-starter-config-monitor (>=0.5.0.release, <=0.6.4.release), org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.2.0, <=5.2.9) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.3.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - io.choerodon:choerodon-starter-config-monitor...

org.springframework.cloud:spring-cloud-config-monitor (1.3.4.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.3.4.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

Spring Cloud Config vulnerable to Path Traversal

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from...

Spring Cloud Config Server Susceptible To TOCTOU Attack

The base directory spring.cloud.config.server.git.basedir used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. - Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 inclusive; no open-source upgrade available. -...

GHSA-J6HH-H3CF-C2HF Spring Cloud Config Server Logged Sensitive Information

When trace logging is enabled in Spring Cloud Config Server, sensitive information is placed in plain text in the logs. - Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 inclusive; no open-source upgrade available. - Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13...

GHSA-86WQ-234Q-R6WG Spring Cloud Config Server Susceptible To TOCTOU Attack

The base directory spring.cloud.config.server.git.basedir used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. - Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 inclusive; no open-source upgrade available. -...

Spring Cloud Config has an Authorization Bypass Through User-Controlled Key

When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 inclusive; upgrade to 3.1.14 or greater...

CVE-2026-41002

The base directory spring.cloud.config.server.git.basedir used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 inclusive; upgrade to 3.1.14 or greater Enterpris...

CVE-2026-40982

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from...

io.github.ilyaslabs.foodstack:configserver (0.0.1), io.github.ilyaslabs:spring-boot-microservice-config-server (1.0.0) +9 more potentially affected by CVE-2026-40981 via org.springframework.cloud:spring-cloud-config-server (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.3.0, =1.0.1, =7.3.0-rc2, =7.3.0-rc2, =26.01.01, =2.3.0, =4.3.0, =3.3.0, =3.3.2 - team.isaz.ark4test.cfgguard:config-guard-starter 1.0.0 - team.isaz.ark4test.cfgguard:config-guard-testkit 1.0.0 Source cves: CVE-2026-40981 Source...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc4) +2 more potentially affected by CVE-2026-40981 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0, <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0, =5.0.0, =5.0.1 Source cves: CVE-2026-40981 Source advisory: MEND:CVE-2026-40981...