CVE-2026-41004
Spring Cloud Config Server Logged Sensitive Information
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
- Record
CVE-2026-41004- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
EUVDEUVD-2026-28250
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
- Record
EUVD-2026-28250- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j6hh-h3cf-c2hf
Spring Cloud Config Server Logged Sensitive Information
When trace logging is enabled in Spring Cloud Config Server, sensitive information is placed in plain text in the logs.
- Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 (inclusive); no open-source upgrade available.
- Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater.
- Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
- Record
GHSA-j6hh-h3cf-c2hf- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
NVD
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
- Record
CVE-2026-41004- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSV
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
- Record
CVE-2026-41004- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVGHSA-j6hh-h3cf-c2hf
Spring Cloud Config Server Logged Sensitive Information
When trace logging is enabled in Spring Cloud Config Server, sensitive information is placed in plain text in the logs.
- Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 (inclusive); no open-source upgrade available.
- Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater.
- Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
- Record
GHSA-j6hh-h3cf-c2hf- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1783299708 No score
TuxCare security update for org.springframework.cloud:spring-cloud-config-server (2 CVEs)
TuxCare rebuilt org.springframework.cloud:spring-cloud-config-server to address 2 CVEs. Fixed in 3.1.6-tuxcare.1.
- Record
CLSA-2026-1783299708- Updated
- 2026-11-02
OSVCLSA-2026-1786543288 No score
TuxCare security update for org.springframework.ws (2 CVEs)
TuxCare rebuilt 6 org.springframework.ws packages to address 2 CVEs. Fixed in 3.1.6-tuxcare.1.
- Record
CLSA-2026-1786543288- Updated
- 2026-11-02
OSVCLSA-2026-1793283637 No score
TuxCare security update for org.springframework.cloud:spring-cloud-config-server (7 CVEs)
TuxCare rebuilt org.springframework.cloud:spring-cloud-config-server to address 7 CVEs. Fixed in 4.2.4-tuxcare.1.
- Record
CLSA-2026-1793283637- Updated
- 2026-11-02
OSVCLSA-2026-1793794350 No score
TuxCare security update for org.springframework.cloud:spring-cloud-config-server (7 CVEs)
TuxCare rebuilt org.springframework.cloud:spring-cloud-config-server to address 7 CVEs. Fixed in 3.1.10-tuxcare.1.
- Record
CLSA-2026-1793794350- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.cloud:spring-cloud-config-serverMaven |
3.1.0 to 3.1.13 | None known |
org.springframework.cloud:spring-cloud-config-serverMaven |
4.1.0 to 4.1.9 | None known |
org.springframework.cloud:spring-cloud-config-serverMaven |
4.2.0 to 4.2.6 | None known |
org.springframework.cloud:spring-cloud-config-serverMaven |
4.3.0 to 4.3.2 | 4.3.3 |
org.springframework.cloud:spring-cloud-config-serverMaven |
5.0.0 to 5.0.2 | 5.0.3 |
org.springframework.cloud:spring-cloud-config-serverMaven |
3.0.0 to 3.0.7 | None known |
org.springframework.cloud:spring-cloud-config-serverTuxCare:Maven From an advisory covering 2 CVEs |
3.1.6 up to 3.1.6-tuxcare.1 | 3.1.6-tuxcare.1 |
org.springframework.cloud:spring-cloud-config-serverTuxCare:Maven From an advisory covering 7 CVEs |
4.2.4 up to 4.2.4-tuxcare.1 | 4.2.4-tuxcare.1 |
org.springframework.cloud:spring-cloud-config-serverTuxCare:Maven From an advisory covering 7 CVEs |
3.1.10 up to 3.1.10-tuxcare.1 | 3.1.10-tuxcare.1 |
org.springframework.cloud:spring-cloud-config-serverMaven |
3.1.0 to 3.1.13, plus listed versions 3.1.13.1.103.1.23.1.33.1.4 Show 5 moreShow less3.1.53.1.63.1.73.1.83.1.9 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.cloud:spring-cloud-config-serverMaven |
4.1.0 to 4.1.9, plus listed versions 4.1.14.1.24.1.34.1.44.1.54.1.64.1.7 |
None known |
org.springframework.cloud:spring-cloud-config-serverMaven |
4.2.0 to 4.2.6, plus listed versions 4.2.14.2.24.2.34.2.4 |
None known |
org.springframework.cloud:spring-cloud-config-serverMaven |
4.3.0 up to 4.3.3, plus listed versions 4.3.14.3.2 |
4.3.3 |
org.springframework.cloud:spring-cloud-config-serverMaven |
5.0.0 up to 5.0.3, plus listed versions 5.0.15.0.2 |
5.0.3 |
org.springframework.cloud:spring-cloud-config-serverMaven |
3.0.0 to 3.0.7, plus listed versions 3.0.13.0.23.0.33.0.43.0.53.0.6 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41004 is a medium vulnerability (CVSS 4.4) in Spring Cloud Config, published May 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in org.springframework.cloud:spring-cloud-config-server 4.3.3.