ROOT-APP-MAVEN-CVE-2026-22739 CVE-2026-22739 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-22739 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41002 CVE-2026-41002 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-41002 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40982 CVE-2026-40982 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-40982 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

Spring Cloud Config Server - Local File Inclusion

Spring Cloud Config Server versions 2.1.x prior to 2.1.2, 2.0.x prior to 2.0.4, 1.4.x prior to 1.4.6, and older unsupported versions are vulnerable to local file inclusion because they allow applications to serve arbitrary configuration files. An attacker can send a request using a specially...

CVE-2026-47894

A flaw was found in Spring Cloud Config Server. This vulnerability allows for the exposure of configuration files outside of their intended repository path. An attacker with high privileges could exploit this flaw through the native environment repository, leading to sensitive information...

CVE-2026-47836

A flaw was found in Spring Cloud Config Server. The base directory used by the server to clone SVN repositories is susceptible to a Time-of-Check Time-of-Use TOCTOU attack. A local attacker with high privileges could exploit this vulnerability by manipulating the directory between the security...

CLEANSTART-2026-SB47522 Security fix for CVE-2026-22741 applied in: activemq 5.19.8-r3, activemq 6.1.8-r1, activemq 6.2.3-r1, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, kafka-ui 1.4.2-r6

CVE-2026-22741 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YX18209 Security fix for CVE-2026-22745 applied in: activemq 5.19.8-r3, activemq 6.1.8-r1, activemq 6.2.3-r1, apache-hive 4.1.0-r5, apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, kafka-ui 1.4.2-r6, spring-boot 3.4.13-r3

CVE-2026-22745 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UJ95320 Security fix for CVE-2026-40976 applied in: cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0

CVE-2026-40976 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DZ11796 Security fix for CVE-2026-40973 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, kafka-ui 1.4.2-r6

CVE-2026-40973 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QX79556 Security fix for CVE-2026-43514 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0

CVE-2026-43514 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BN96016 Security fix for CVE-2026-42498 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-42498 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MU35489 Security fix for CVE-2026-43513 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-43513 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MV28193 Security fix for CVE-2026-41284 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-41284 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SE01248 Security fix for CVE-2026-43515 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-43515 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OD91042 Security fix for CVE-2026-43512 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-43512 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NC17468 Security fix for CVE-2026-41293 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, tomcat10 10.0.27-r1

CVE-2026-41293 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GO18294 Security fix for CVE-2026-22746 applied in: apache-nifi 2.7.2-r7, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, kafka-ui 1.4.2-r6, rundeck 6.0.0-r0

CVE-2026-22746 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WO51602 Security fix for CVE-2026-22751 applied in: apache-nifi 2.7.2-r7, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, kafka-ui 1.4.2-r6, rundeck 6.0.0-r0

CVE-2026-22751 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through the spring.cloud.config.server.svn.basedir...