cn.home1:oss-configserver (>=1.0.6.oss, <=1.0.7.oss) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.2.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - cn.home1:oss-configserver =1.0.6.oss, =1.0.7.os...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +6 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.2.0, =0.0.1, =1.0.0, =3.0.9, =0.1.41-beta, =7.2.0-rc3, =7.2.0-rc3, =4.2.0, =3.2.0, =3.2.3 Source cves: CVE-2026-40982 Source advisory: OSV:GHSA-6G23-24MC-HX6X...

io.choerodon:choerodon-starter-config-monitor (>=0.5.0.release, <=0.6.4.release), org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.2.0, <=5.2.9) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.3.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - io.choerodon:choerodon-starter-config-monitor...

GHSA-6G23-24MC-HX6X Spring Cloud Config vulnerable to Path Traversal

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from...

io.github.ilyaslabs.foodstack:configserver (0.0.1), io.github.ilyaslabs:spring-boot-microservice-config-server (1.0.0) +9 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.3.0, =1.0.1, =7.3.0-rc2, =7.3.0-rc2, =26.01.01, =2.3.0, =4.3.0, =3.3.0, =3.3.2 - team.isaz.ark4test.cfgguard:config-guard-starter 1.0.0 - team.isaz.ark4test.cfgguard:config-guard-testkit 1.0.0 Source cves: CVE-2026-41002 Source...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (2021.0.1.0), com.bpfaas:bps-config-server-novault-spring-cloud-starter (3.2.2) +35 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=3.1.0, <=3.1.10)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.1.0, =3.0.0, =2.1.4, =0.1, =5.84.0, =5.84.0, =5.95.0 and more Source cves: CVE-2026-41002 Source advisory: OSV...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc4) +2 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0, <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0, =5.0.0, =5.0.1 Source cves: CVE-2026-41002 Source advisory: OSV:GHSA-86WQ-234Q-R6WG...

com.ecfront.dew:config (>=1.0.0, <=1.1.1), org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.1.0-rc4, <=5.1.9) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.3.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - com.ecfront.dew:config =1.0.0, =5.1.0-rc4,...

ai.hyacinth.framework:core-service-config-server (0.5.0), org.springframework.cloud.stream.app:spring-cloud-stream-app-starters-docs (>=einstein.sr1, <=einstein.sr3) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - ai.hyacinth.framework:core-service-config-serve...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +6 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.2.0, =0.0.1, =1.0.0, =3.0.9, =0.1.41-beta, =7.2.0-rc3, =7.2.0-rc3, =4.2.0, =3.2.0, =3.2.3 Source cves: CVE-2026-41002 Source advisory: OSV:GHSA-86WQ-234Q-R6WG...

GHSA-J6HH-H3CF-C2HF Spring Cloud Config Server Logged Sensitive Information

When trace logging is enabled in Spring Cloud Config Server, sensitive information is placed in plain text in the logs. - Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 inclusive; no open-source upgrade available. - Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13...

Spring Cloud Config Server Logged Sensitive Information

When trace logging is enabled in Spring Cloud Config Server, sensitive information is placed in plain text in the logs. - Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 inclusive; no open-source upgrade available. - Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2.2.2.release, <=2.2.5.release), com.geektcp.common:thy-common-config (>=1.0.0, <=1.0.7) +13 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.5.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (6.3.0-rc2), org.apereo.cas:cas-server-webapp-init-config-server (6.3.0-rc2) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.4.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

io.mosip.kernel:kernel-config-server (>=1.2.1-rc1, <=1.3.1), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=7.0.0, <=7.1.6.2) +5 more potentially affected by CVE-2026-40981 via org.springframework.cloud:spring-cloud-config-server (>=4.1.0, <=4.1.7)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.1.0, =1.2.1-rc1, =7.0.0, =7.0.0, =4.1.0, =3.1.0, =3.1.6 Source cves: CVE-2026-40981 Source advisory: GHSA-2MH5-3CW6-HRRQ...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2020.0.rc1, <=2021.1), com.bpfaas:bps-config-server-novault-spring-cloud-starter (3.2.2) +38 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=3.0.0, <=3.1.10)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.0.0, =2020.0.rc1, =3.0.0, =2.1.0, =0.1, =0.0.3, =0.8.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =5.79.0, =5.95.0 and more Source cves: CVE-2026-4...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2020.0.rc1, <=2021.1), com.okta.spring.examples:okta-spring-boot-cloud-config-example (>=2.1.0, <=2.1.3) +30 more potentially affected by CVE-2026-41004 via org.springframework.cloud:spring-cloud-config-server (>=3.0.0, <=3.0.7)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.0.0, =2020.0.rc1, =2.1.0, =0.0.3, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =5.79.0, =5.79.0, =5.79.0, =5.80.0, =5.79.0, =5.79.0, =5.83.4 and more Source c...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc4) +2 more potentially affected by CVE-2026-40981 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0, <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0, =8.0.0-rc1, =8.0.0-rc1, =5.0.0, =5.0.0, =5.0.1 Source cves: CVE-2026-40981 Source advisory: GHSA-2MH5-3CW6-HRRQ...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +6 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.2.0, =0.0.1, =1.0.0, =3.0.9, =0.1.41-beta, =7.2.0-rc3, =7.2.0-rc3, =4.2.0, =3.2.0, =3.2.3 Source cves: CVE-2026-40982 Source advisory: GHSA-6G23-24MC-HX6X...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2.2.5.rocketmq.rc2, <=2.2.6.release), com.github.niupengyu:ahead-frame-commons (1.2.5-release) +12 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.6.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...