# org.springframework.cloud:spring-cloud-config-server (Maven) vulnerabilities 8 known vulnerabilities (1 critical, 4 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.0.6 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 5.0.6 (Oct 22, 2026), the latest release - Dependents: 5 - Releases: 110 since 1.0.0.RELEASE (Mar 3, 2015) - Registry: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-config-server - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-40981: 3.1.0 to 3.1.10 (4.0.0 is outside it); 4.1.0 to 4.3.2 (4.3.3 is outside it); 5.0.0 to 5.0.2 (5.0.3 is outside it) - CVE-2026-41002: 3.0.0 to 3.1.10 (4.0.0 is outside it); 4.1.0 to 4.3.2 (4.3.3 is outside it); 5.0.0 to 5.0.2 (5.0.3 is outside it) - CVE-2026-41004: 3.0.0 to 3.1.10 (4.0.0 is outside it); 4.1.0 to 4.3.2 (4.3.3 is outside it); 5.0.0 to 5.0.2 (5.0.3 is outside it) - CVE-2026-40982: 1.0.0.RELEASE to 3.1.10 (4.0.0 is outside it); 4.1.0 to 4.3.2 (4.3.3 is outside it); 5.0.0 to 5.0.2 (5.0.3 is outside it) - CVE-2026-22739: 1.0.0.RELEASE to 4.3.1 (4.3.2 is outside it); 5.0.0-M1 to 5.0.1 (5.0.2 is outside it) - CVE-2020-5410: 2.1.0.RELEASE to 2.1.8.RELEASE (2.1.9.RELEASE is outside it); 2.2.0.RELEASE to 2.2.2.RELEASE (2.2.3.RELEASE is outside it) - CVE-2020-5405: 2.1.0.RELEASE to 2.1.6.RELEASE (2.1.7.RELEASE is outside it); 2.2.0.RELEASE to 2.2.1.RELEASE (2.2.2.RELEASE is outside it) - CVE-2019-3799: 1.0.0.RELEASE to 1.4.5.RELEASE (1.4.6.RELEASE is outside it); 2.0.0.RELEASE to 2.0.3.RELEASE (2.0.4.RELEASE is outside it); 2.1.0.RELEASE to 2.1.1.RELEASE (2.1.2.RELEASE is outside it) ## Advisories (8) ### [CVE-2026-40981](https://cve.now/CVE-2026-40981): When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server… - Severity: High 7.5 - Published: May 7, 2026 - Affected: from 3.1.0, through 3.1.13; from 4.1.0, through 4.1.9; from 4.2.0, through 4.2.6; from 4.3.0, fixed in 4.3.3; from 5.0.0, fixed in 5.0.3. - Fixed in 4.3.3 (released May 6, 2026, 1 day before disclosure) and 5.0.3 (released May 6, 2026, 1 day before disclosure). - The latest release, 5.0.6, is not affected. ### [CVE-2026-41002](https://cve.now/CVE-2026-41002): The base directory (\`spring.cloud.config.server.git.basedir\`) used by the Spring Cloud Config Server to clone Git repositories to is… - Severity: High 7.4 - Published: May 7, 2026 - Affected: from 3.1.0, through 3.1.13; from 4.1.0, through 4.1.9; from 4.2.0, through 4.2.6; from 4.3.0, fixed in 4.3.3; from 5.0.0, fixed in 5.0.3; from 3.0.0, through 3.0.7. - Fixed in 4.3.3 (released May 6, 2026, 1 day before disclosure) and 5.0.3 (released May 6, 2026, 1 day before disclosure). - The latest release, 5.0.6, is not affected. ### [CVE-2026-41004](https://cve.now/CVE-2026-41004): When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. - Severity: Medium 4.4 - Published: May 7, 2026 - Affected: from 3.1.0, through 3.1.13; from 4.1.0, through 4.1.9; from 4.2.0, through 4.2.6; from 4.3.0, fixed in 4.3.3; from 5.0.0, fixed in 5.0.3; from 3.0.0, through 3.0.7. - Fixed in 4.3.3 (released May 6, 2026, 1 day before disclosure) and 5.0.3 (released May 6, 2026, 1 day before disclosure). - The latest release, 5.0.6, is not affected. ### [CVE-2026-40982](https://cve.now/CVE-2026-40982): Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. - Severity: Critical 9.1 - Published: May 7, 2026 - Affected: through 3.1.13; from 4.1.0, through 4.1.9; from 4.2.0, through 4.2.6; from 4.3.0, fixed in 4.3.3; from 5.0.0, fixed in 5.0.3. - Fixed in 4.3.3 (released May 6, 2026, 1 day before disclosure) and 5.0.3 (released May 6, 2026, 1 day before disclosure). - The latest release, 5.0.6, is not affected. ### [CVE-2026-22739](https://cve.now/CVE-2026-22739): Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks - Severity: High 8.6 - Published: Mar 24, 2026 - Affected: from 4.3.0, fixed in 4.3.2; from 5.0.0-M1, fixed in 5.0.2; from 4.2.0, through 4.2.4; from 4.0.0, through 4.1.7; through 3.1.10. - Fixed in 4.3.2 (released Mar 23, 2026, 1 day before disclosure) and 5.0.2 (released Mar 23, 2026, 1 day before disclosure). - The latest release, 5.0.6, is not affected. ### [CVE-2020-5410](https://cve.now/CVE-2020-5410): Directory Traversal with spring-cloud-config-server - Severity: High 7.5 · KEV - Published: Jun 2, 2020 - Affected: from 2.1.0, fixed in 2.1.9; from 2.2.0, fixed in 2.2.3. - Fixed in 2.1.9.RELEASE (released May 28, 2020, 5 days before disclosure) and 2.2.3.RELEASE (released May 28, 2020, 5 days before disclosure). - The latest release, 5.0.6, is not affected. ### [CVE-2020-5405](https://cve.now/CVE-2020-5405): Directory Traversal with spring-cloud-config-server - Severity: Unrated - Published: Mar 5, 2020 - Affected: from 2.1.0, fixed in 2.1.7; from 2.2.0, fixed in 2.2.2. - Fixed in 2.1.7.RELEASE (released Mar 2, 2020, 3 days before disclosure) and 2.2.2.RELEASE (released Mar 4, 2020, 1 day before disclosure). - The latest release, 5.0.6, is not affected. ### [CVE-2019-3799](https://cve.now/CVE-2019-3799): Directory Traversal with spring-cloud-config-server - Severity: Unrated - Published: May 6, 2019 - Affected: fixed in 1.4.6; from 2.0.0, fixed in 2.0.4; from 2.1.0, fixed in 2.1.2. - Fixed in 1.4.6.RELEASE (released Apr 16, 2019, 20 days before disclosure), 2.0.4.RELEASE (released Apr 16, 2019, 20 days before disclosure) and 2.1.2.RELEASE (released Apr 16, 2019, 20 days before disclosure). - The latest release, 5.0.6, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.springframework.cloud:spring-cloud-config-server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.