org.springframework.cloud:spring-cloud-config-monitor (2.1.6.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.6.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

ai.hyacinth.framework:core-service-config-server (0.5.0), org.springframework.cloud.stream.app:spring-cloud-stream-app-starters-docs (>=einstein.sr1, <=einstein.sr3) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - ai.hyacinth.framework:core-service-config-serve...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2.2.5.rocketmq.rc2, <=2.2.6.release), com.github.niupengyu:ahead-frame-commons (1.2.5-release) +12 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.6.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

com.ixortalk:ixortalk-test (>=1.0.0, <=1.1.3), com.thinkbiganalytics.kylo.plugins:kylo-hadoop-authorization-ranger (>=0.8.3, <=0.9.1) +105 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.1.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - com.ixortalk:ixortalk-test =1.0.0, =0.8.3,...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (2.1.2.release), org.springframework.cloud:spring-cloud-config-monitor (2.1.7.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.7.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2020.0.rc1, <=2021.1), com.bpfaas:bps-config-server-novault-spring-cloud-starter (3.2.2) +38 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=3.0.0, <=3.1.10)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.0.0, =2020.0.rc1, =3.0.0, =2.1.0, =0.1, =0.0.3, =0.8.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =5.79.0, =5.95.0 and more Source cves: CVE-2026-4...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2020.0.rc1, <=2021.1), com.bpfaas:bps-config-server-novault-spring-cloud-starter (3.2.2) +38 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=3.0.0, <=3.1.10)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.0.0, =2020.0.rc1, =3.0.0, =2.1.0, =0.1, =0.0.3, =0.8.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =5.79.0, =5.95.0 and more Source cves: CVE-2026-4...

io.github.ilyaslabs.foodstack:configserver (0.0.1), io.github.ilyaslabs:spring-boot-microservice-config-server (1.0.0) +9 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.3.0, =1.0.1, =7.3.0-rc2, =7.3.0-rc2, =26.01.01, =2.3.0, =4.3.0, =3.3.0, =3.3.2 - team.isaz.ark4test.cfgguard:config-guard-starter 1.0.0 - team.isaz.ark4test.cfgguard:config-guard-testkit 1.0.0 Source cves: CVE-2026-41002 Source...

com.ecfront.dew:config (>=1.1.2, <=1.1.4), org.apereo.cas:cas-server-core-configuration-cloud-amqp (5.2.0-rc1) +11 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.3.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - com.ecfront.dew:config =1.1.2, =1.0.0.release,...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (2021.0.1.0), com.bpfaas:bps-config-server-novault-spring-cloud-starter (3.2.2) +34 more potentially affected by CVE-2026-40981 via org.springframework.cloud:spring-cloud-config-server (>=3.1.0, <=3.1.10)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.1.0, =3.0.0, =2.1.4, =0.1, =5.84.0, =5.84.0, =5.95.0 and more Source cves: CVE-2026-40981 Source advisory: GHS...

io.mosip.kernel:kernel-config-server (>=1.2.1-rc1, <=1.3.1), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=7.0.0, <=7.1.6.2) +5 more potentially affected by CVE-2026-41004 via org.springframework.cloud:spring-cloud-config-server (>=4.1.0, <=4.1.7)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.1.0, =1.2.1-rc1, =7.0.0, =7.0.0, =4.1.0, =3.1.0, =3.1.6 Source cves: CVE-2026-41004 Source advisory: OSV:GHSA-J6HH-H3CF-C2HF...

io.mosip.kernel:kernel-config-server (>=1.2.1-rc1, <=1.3.1), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=7.0.0, <=7.1.6.2) +5 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=4.1.0, <=4.1.7)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.1.0, =1.2.1-rc1, =7.0.0, =7.0.0, =4.1.0, =3.1.0, =3.1.6 Source cves: CVE-2026-40982 Source advisory: OSV:GHSA-6G23-24MC-HX6X...

com.bpfaas:bps-config-server-novault-spring-cloud-starter (>=3.0.1.release, <=3.0.3.release), com.bpfaas:bps-config-server-spring-cloud-starter (>=3.0.1.release, <=3.0.3.release) +6 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

GHSA-J6HH-H3CF-C2HF Spring Cloud Config Server Logged Sensitive Information

When trace logging is enabled in Spring Cloud Config Server, sensitive information is placed in plain text in the logs. - Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 inclusive; no open-source upgrade available. - Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13...

Spring Cloud Config Server Susceptible To TOCTOU Attack

The base directory spring.cloud.config.server.git.basedir used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. - Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 inclusive; no open-source upgrade available. -...

org.springframework.cloud:spring-cloud-config-monitor (2.1.8.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.8.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

io.github.ilyaslabs.foodstack:configserver (0.0.1), io.github.ilyaslabs:spring-boot-microservice-config-server (1.0.0) +9 more potentially affected by CVE-2026-41004 via org.springframework.cloud:spring-cloud-config-server (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.3.0, =1.0.1, =7.3.0-rc2, =7.3.0-rc2, =26.01.01, =2.3.0, =4.3.0, =3.3.0, =3.3.2 - team.isaz.ark4test.cfgguard:config-guard-starter 1.0.0 - team.isaz.ark4test.cfgguard:config-guard-testkit 1.0.0 Source cves: CVE-2026-41004 Source...

com.ecfront.dew:config (>=1.0.0, <=1.1.1), org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.1.0-rc4, <=5.1.9) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.3.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - com.ecfront.dew:config =1.0.0, =5.1.0-rc4,...

io.choerodon:choerodon-starter-config-monitor (>=0.5.0.release, <=0.6.4.release), org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.2.0, <=5.2.9) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.3.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - io.choerodon:choerodon-starter-config-monitor...

com.buession.springcloud:buession-springcloud-config-server (>=1.2.1, <=1.2.2), org.openwms:org.openwms.configuration (1.2.0) +3 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.7.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...