com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2020.0.rc1, <=2021.1), com.okta.spring.examples:okta-spring-boot-cloud-config-example (>=2.1.0, <=2.1.3) +30 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=3.0.0, <=3.0.7)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.0.0, =2020.0.rc1, =2.1.0, =0.0.3, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =5.79.0, =5.79.0, =5.79.0, =5.80.0, =5.79.0, =5.79.0, =5.83.4 and more Source c...

io.mosip.kernel:kernel-config-server (>=1.2.1-rc1, <=1.3.1), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=7.0.0, <=7.1.6.2) +5 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=4.1.0, <=4.1.7)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.1.0, =1.2.1-rc1, =7.0.0, =7.0.0, =4.1.0, =3.1.0, =3.1.6 Source cves: CVE-2026-41002 Source advisory: OSV:GHSA-86WQ-234Q-R6WG...

io.github.ilyaslabs.foodstack:configserver (0.0.1), io.github.ilyaslabs:spring-boot-microservice-config-server (1.0.0) +9 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.3.0, =1.0.1, =7.3.0-rc2, =7.3.0-rc2, =26.01.01, =2.3.0, =4.3.0, =3.3.0, =3.3.2 - team.isaz.ark4test.cfgguard:config-guard-starter 1.0.0 - team.isaz.ark4test.cfgguard:config-guard-testkit 1.0.0 Source cves: CVE-2026-41002 Source...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (2021.0.1.0), com.bpfaas:bps-config-server-novault-spring-cloud-starter (3.2.2) +35 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=3.1.0, <=3.1.10)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.1.0, =3.0.0, =2.1.4, =0.1, =5.84.0, =5.84.0, =5.95.0 and more Source cves: CVE-2026-41002 Source advisory: OSV...

GHSA-86WQ-234Q-R6WG Spring Cloud Config Server Susceptible To TOCTOU Attack

The base directory spring.cloud.config.server.git.basedir used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. - Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 inclusive; no open-source upgrade available. -...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2020.0.rc1, <=2021.1), com.okta.spring.examples:okta-spring-boot-cloud-config-example (>=2.1.0, <=2.1.3) +30 more potentially affected by CVE-2026-41004 via org.springframework.cloud:spring-cloud-config-server (>=3.0.0, <=3.0.7)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.0.0, =2020.0.rc1, =2.1.0, =0.0.3, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =5.79.0, =5.79.0, =5.79.0, =5.80.0, =5.79.0, =5.79.0, =5.83.4 and more Source c...

org.springframework.cloud:spring-cloud-config-monitor (2.1.8.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.8.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

org.springframework.cloud:spring-cloud-config-monitor (1.4.7.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.4.7.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2020.0.rc1, <=2021.1), com.bpfaas:bps-config-server-novault-spring-cloud-starter (3.2.2) +38 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=3.0.0, <=3.1.10)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.0.0, =2020.0.rc1, =3.0.0, =2.1.0, =0.1, =0.0.3, =0.8.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =5.79.0, =5.95.0 and more Source cves: CVE-2026-4...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (6.3.0-rc2), org.apereo.cas:cas-server-webapp-init-config-server (6.3.0-rc2) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.4.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc4) +2 more potentially affected by CVE-2026-40981 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0, <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0, =5.0.0, =5.0.1 Source cves: CVE-2026-40981 Source advisory: OSV:GHSA-2MH5-3CW6-HRRQ...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2.1.3.release, <=2.1.4.release), org.springframework.cloud:spring-cloud-config-monitor (2.1.9.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.9.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

GHSA-J6HH-H3CF-C2HF Spring Cloud Config Server Logged Sensitive Information

When trace logging is enabled in Spring Cloud Config Server, sensitive information is placed in plain text in the logs. - Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 inclusive; no open-source upgrade available. - Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13...

org.springframework.cloud:spring-cloud-config-monitor (1.4.6.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.4.6.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

io.mosip.kernel:kernel-config-server (1.0.6), org.springframework.cloud.stream.app:spring-cloud-stream-app-starters-docs (>=darwin.release, <=darwin.sr1) +1 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.0.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - io.mosip.kernel:kernel-config-server 1.0.6 -...

it.cnr.si:parco-auto (>=1.0.2, <=2.0.24), it.cnr.si:telefonia-mobile (>=0.0.2, <=2.0.24) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.0.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - it.cnr.si:parco-auto =1.0.2, =0.0.2, =2.0.24 -...

com.okta.spring.examples:okta-spring-boot-cloud-config-example (>=1.0.0, <=1.1.0), com.yoozoo.protoconf:protoconf-java (>=0.2.2, <=0.2.3) +4 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.0.2.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

org.springframework.cloud:spring-cloud-alibaba-nacos-config-server (0.2.2.release), org.springframework.cloud:spring-cloud-config-monitor (2.0.3.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.0.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

io.mosip.kernel:kernel-config-server (>=1.1.2-rc2, <=1.1.2), org.springframework.cloud:spring-cloud-config-monitor (2.0.4.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.0.4.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - io.mosip.kernel:kernel-config-server =1.1.2-rc2...

com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.0.0.release, <=2.0.1.release), com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2.0.2.release, <=2.0.4.release) +1 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.0.5.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...