CVE-2026-41002

CVE-2026-41002 affects Spring Cloud Config Server where the base directory used to clone Git repositories (spring.cloud.config.server.git.basedir) is vulnerable to time-of-check-time-of-use (TOCTOU) issues. Affected ranges and upgrades: Spring Cloud Config 3.1.x: 3.1.0–3.1.13 → upgrade to 3.1.14+...

CVE-2026-41002

The base directory spring.cloud.config.server.git.basedir used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 inclusive; upgrade to 3.1.14 or greater Enterpris...

io.github.ilyaslabs.foodstack:configserver (0.0.1), io.github.ilyaslabs:spring-boot-microservice-config-server (1.0.0) +9 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.3.0, =1.0.1, =7.3.0-rc2, =7.3.0-rc2, =26.01.01, =2.3.0, =4.3.0, =3.3.0, =3.3.2 - team.isaz.ark4test.cfgguard:config-guard-starter 1.0.0 - team.isaz.ark4test.cfgguard:config-guard-testkit 1.0.0 Source cves: CVE-2026-41002 Source...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc4) +2 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0, <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0, =5.0.0, =5.0.1 Source cves: CVE-2026-41002 Source advisory: MEND:CVE-2026-41002...

CVE-2026-41002

The base directory spring.cloud.config.server.git.basedir used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 inclusive; upgrade to 3.1.14 or greater Enterpris...

CVE-2026-41004

The CVE-2026-41004 affects Spring Cloud Config Server when trace logging is enabled, exposing sensitive information in plain text in logs. All affected branches and versions include: Spring Cloud Config 3.1.x (3.1.0–3.1.13) with upgrade to 3.1.14+; 4.1.x (4.1.0–4.1.9) upgrade to 4.1.10+; 4.2.x (4...

CVE-2026-41004

When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 inclusive; upgrade to 3.1.14 or greater Enterprise Support Only. Spring Cloud Config 4.1.x: affected from 4.1.0 throu...

CVE-2026-41004

When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 inclusive; upgrade to 3.1.14 or greater Enterprise Support Only. Spring Cloud Config 4.1.x: affected from 4.1.0 throu...

CVE-2026-41004

When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 inclusive; upgrade to 3.1.14 or greater Enterprise Support Only. Spring Cloud Config 4.1.x: affected from 4.1.0 throu...

io.github.ilyaslabs.foodstack:configserver (0.0.1), io.github.ilyaslabs:spring-boot-microservice-config-server (1.0.0) +9 more potentially affected by CVE-2026-41004 via org.springframework.cloud:spring-cloud-config-server (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.3.0, =1.0.1, =7.3.0-rc2, =7.3.0-rc2, =26.01.01, =2.3.0, =4.3.0, =3.3.0, =3.3.2 - team.isaz.ark4test.cfgguard:config-guard-starter 1.0.0 - team.isaz.ark4test.cfgguard:config-guard-testkit 1.0.0 Source cves: CVE-2026-41004 Source...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc4) +2 more potentially affected by CVE-2026-41004 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0, <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0, =5.0.0, =5.0.1 Source cves: CVE-2026-41004 Source advisory: MEND:CVE-2026-41004...

CVE-2026-41004

When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 inclusive; upgrade to 3.1.14 or greater Enterprise Support Only. Spring Cloud Config 4.1.x: affected from 4.1.0 throu...

CVE-2026-40982

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from...

CVE-2026-40982

Spring Cloud Config server (spring-cloud-config-server) is vulnerable to a directory-traversal issue that allows serving arbitrary text and binary files via crafted URLs. Affected versions: Spring Cloud Config 3.1.x (3.1.0–3.1.13); upgrade to 3.1.14+. 4.1.x (4.1.0–4.1.9); upgrade to 4.1.10+. 4.2....

CVE-2026-40982

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from...

io.github.ilyaslabs.foodstack:configserver (0.0.1), io.github.ilyaslabs:spring-boot-microservice-config-server (1.0.0) +9 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.3.0, =1.0.1, =7.3.0-rc2, =7.3.0-rc2, =26.01.01, =2.3.0, =4.3.0, =3.3.0, =3.3.2 - team.isaz.ark4test.cfgguard:config-guard-starter 1.0.0 - team.isaz.ark4test.cfgguard:config-guard-testkit 1.0.0 Source cves: CVE-2026-40982 Source...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc4) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0, <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0, =5.0.0, =5.0.1 Source cves: CVE-2026-40982 Source advisory: MEND:CVE-2026-40982...

PT-2026-38331

Name of the Vulnerable Software and Affected Versions Spring Cloud Config versions 3.1.0 through 3.1.13 Spring Cloud Config versions 4.1.0 through 4.1.9 Spring Cloud Config versions 4.2.0 through 4.2.6 Spring Cloud Config versions 4.3.0 through 4.3.2 Spring Cloud Config versions 5.0.0 through 5.0...

PT-2026-38332

Name of the Vulnerable Software and Affected Versions Spring Cloud Config versions 3.1.0 through 3.1.13 Spring Cloud Config versions 4.1.0 through 4.1.9 Spring Cloud Config versions 4.2.0 through 4.2.6 Spring Cloud Config versions 4.3.0 through 4.3.2 Spring Cloud Config versions 5.0.0 through 5.0...

CVE-2026-40982: Improper Limitation of a Pathname to a Restricted Directory

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from...