1012 matches found
CVE-2026-69854
CVE-2026-69854 is an improper authentication vulnerability in Spring Cloud Azure that allows an unauthorized attacker to elevate privileges over a network . The CNA (Microsoft) assigned a CVSS 3.1 score of 9.0 (CRITICAL) with a changed scope , reflecting high impact on confidentiality, integrity,...
Directory Traversal
Spring Cloud Config is vulnerable to Directory Traversal. The vulnerability is due to improper restriction of configuration file access in the native environment repository, which allows an attacker to access configuration files outside the configured repository path...
Spring Cloud Azure Elevation of Privilege Vulnerability
Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...
Server-Side Request Forgery (SSRF)
Spring Cloud Gateway is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to JsonToGrpcGatewayFilterFactory allowing arbitrary Spring Resource locations for the proto descriptor, which allows an attacker to access or load unintended resources from the server...
Sensitive Data Exposure
org.springframework.cloud, spring-cloud-function-adapter-aws is vulnerable to sensitive data exposure. The vulnerability is due to sensitive information being included in application logs, which allows an attacker with access to the logs to obtain potentially confidential data...
Base Function Poisoning
Spring Cloud Function is vulnerable to base function poisoning. The vulnerability is due to improper handling of function composition lookup, which allows an attacker to manipulate or poison the base function and potentially execute unintended function compositions...
Insecure Deserialization
Spring Cloud Stream is vulnerable to insecure deserialization. The vulnerability is due to deserialization of untrusted types, where crafted serialized objects are deserialized without validation and attackers can supply malicious payloads to achieve code execution...
PT-2026-87760
Name of the Vulnerable Software and Affected Versions Spring Cloud Azure affected versions not specified Description Improper authentication allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version that...
CVE-2026-69854: Improper Authentication
Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...
Unbounded Cache Size
Spring Cloud Stream is vulnerable to an unbounded cache size. The vulnerability is due to improper bounding of the dynamic destination cache size, where the cache can grow without limit and attackers can trigger excessive memory usage to cause a denial‑of‑service condition...
Sensitive Data Logging
Spring Cloud Function is vulnerable to Sensitive Data Logging. The vulnerability is due to insufficient redaction of sensitive information in its logging mechanisms, where request or response data may be written to logs without filtering and attackers can trigger the function with secret‑containi...
Scheme Verification Bypass
Spring Cloud Function is vulnerable to Scheme Verification Bypass. The vulnerability is due to the implementation of the isSecure method in ServerlessHttpServletRequest not verifying the actual scheme, where the method can report a request as secure even when the scheme is not HTTPS and an attack...
Missing Authentication
Spring Cloud Config is vulnerable to a Missing Authentication for Critical Function. The vulnerability is due to unvalidated Webhook requests to the Spring Cloud Config Server’s /monitor endpoint, which allows an attacker to send unauthorized requests and potentially trigger protected functionali...
Time-of-Check Time-of-Use (TOCTOU)
Spring Cloud Config is vulnerable to a Time-of-Check Time-of-Use TOCTOU vulnerability. The vulnerability is due to insufficient synchronization between checking and using the SVN repository base directory, which allows an attacker to exploit the time gap to manipulate the directory and potentiall...
Security Bulletin: Security Vulnerability in Spring Cloud Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-41235)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability in Spring Cloud Vulnerability Details CVEID:CVE-2025-41235 DESCRIPTION: Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies. CWE:CWE-444:...
CVE-2026-59315
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...
CVE-2026-59305
Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...
CVE-2026-59299
Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...
CVE-2026-59298
Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...