CVE-2026-40982
Spring Cloud Config vulnerable to Path Traversal
CVE-2026-40982 is a critical vulnerability (CVSS 9.1) in Spring Cloud Config, published May 7, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in org.springframework.cloud:spring-cloud-config-server 4.3.3.
- Severity
- 9.1 CriticalCVSS 3.1, CVE List
- Exploit chance
- 0.73%EPSS, 54th percentile
- Exploitation
- None known1 public exploit
Description
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.cloud:spring-cloud-config-serverMaven | 4.1.0 to 4.1.9 | None known |
org.springframework.cloud:spring-cloud-config-serverMaven | 4.2.0 to 4.2.6 | None known |
org.springframework.cloud:spring-cloud-config-serverMaven | 4.3.0 to 4.3.2 | 4.3.3 |
org.springframework.cloud:spring-cloud-config-serverMaven | 5.0.0 to 5.0.2 | 5.0.3 |
org.springframework.cloud:spring-cloud-config-serverMaven | through 3.1.13 | None known |
org.springframework.cloud:spring-cloud-config-serverTuxCare:Maven From an advisory covering 2 CVEs | 3.1.6 up to 3.1.6-tuxcare.1 | 3.1.6-tuxcare.1 |
org.springframework.cloud:spring-cloud-config-serverTuxCare:Maven From an advisory covering 7 CVEs | 4.2.4 up to 4.2.4-tuxcare.1 | 4.2.4-tuxcare.1 |
org.springframework.cloud:spring-cloud-config-serverTuxCare:Maven From an advisory covering 7 CVEs | 3.1.10 up to 3.1.10-tuxcare.1 | 3.1.10-tuxcare.1 |
org.springframework.cloud:spring-cloud-config-serverMaven | through 3.1.13, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.0.3.RELEASE1.0.4.RELEASE Show 45 moreShow less1.1.0.RELEASE1.1.1.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.2.0.M11.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.4.7.RELEASE2.0.0.RELEASE2.0.1.RELEASE2.0.2.RELEASE2.0.3.RELEASE2.0.4.RELEASE2.0.5.RELEASE2.1.0.RELEASE2.1.1.RELEASE2.1.2.RELEASE2.1.3.RELEASE2.1.4.RELEASE2.1.5.RELEASE2.1.6.RELEASE2.1.7.RELEASE2.1.8.RELEASE2.1.9.RELEASE2.2.0.RELEASE2.2.1.RELEASE2.2.2.RELEASE2.2.3.RELEASE2.2.4.RELEASE2.2.5.RELEASE2.2.6.RELEASE | None known |
org.springframework.cloud:spring-cloud-config-serverMaven | 4.1.0 to 4.1.9, plus listed versions 4.1.14.1.24.1.34.1.44.1.54.1.64.1.7 | None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.cloud:spring-cloud-config-serverMaven | 4.2.0 to 4.2.6, plus listed versions 4.2.14.2.24.2.34.2.4 | None known |
org.springframework.cloud:spring-cloud-config-serverMaven | 4.3.0 up to 4.3.3, plus listed versions 4.3.14.3.2 | 4.3.3 |
org.springframework.cloud:spring-cloud-config-serverMaven | 5.0.0 up to 5.0.3, plus listed versions 5.0.15.0.2 | 5.0.3 |
org.springframework.cloud:spring-cloud-config-serverRoot:Maven | before 4.3.0-aikido.2 | 4.3.0-aikido.2 |
io.root.org.springframework.cloud:spring-cloud-config-serverRoot:Maven | before 4.3.0-root.io.2 | 4.3.0-root.io.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | xiaoqiMikko/scc-check | 2026-08-05 |
What each source reports
CVE List Score used
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
- Record
CVE-2026-40982- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-22, CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-28246
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
- Record
EUVD-2026-28246- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6g23-24mc-hx6x
Spring Cloud Config vulnerable to Path Traversal
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
- Record
GHSA-6g23-24mc-hx6x- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
- Record
CVE-2026-40982- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
- Record
CVE-2026-40982- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-6g23-24mc-hx6x
Spring Cloud Config vulnerable to Path Traversal
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
- Record
GHSA-6g23-24mc-hx6x- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Show 5 moreShow less
OSVCLSA-2026-1783299708No score
TuxCare security update for org.springframework.cloud:spring-cloud-config-server (2 CVEs)
TuxCare rebuilt org.springframework.cloud:spring-cloud-config-server to address 2 CVEs. Fixed in 3.1.6-tuxcare.1.
- Record
CLSA-2026-1783299708- Updated
- 2026-11-02
OSVCLSA-2026-1786543288No score
TuxCare security update for org.springframework.ws (2 CVEs)
TuxCare rebuilt 6 org.springframework.ws packages to address 2 CVEs. Fixed in 3.1.6-tuxcare.1.
- Record
CLSA-2026-1786543288- Updated
- 2026-11-02
OSVCLSA-2026-1793283637No score
TuxCare security update for org.springframework.cloud:spring-cloud-config-server (7 CVEs)
TuxCare rebuilt org.springframework.cloud:spring-cloud-config-server to address 7 CVEs. Fixed in 4.2.4-tuxcare.1.
- Record
CLSA-2026-1793283637- Updated
- 2026-11-02
OSVCLSA-2026-1793794350No score
TuxCare security update for org.springframework.cloud:spring-cloud-config-server (7 CVEs)
TuxCare rebuilt org.springframework.cloud:spring-cloud-config-server to address 7 CVEs. Fixed in 3.1.10-tuxcare.1.
- Record
CLSA-2026-1793794350- Updated
- 2026-11-04
OSVROOT-APP-MAVEN-CVE-2026-40982No score
CVE-2026-40982 in org.springframework.cloud:spring-cloud-config-server - Patched by Root
Root has patched CVE-2026-40982 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-40982- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
spring.io/security/cve-2026-40982
access.redhat.com/security/cve/CVE-2026-40982
bugzilla.redhat.com/show_bug.cgi?id=2467619
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40982.json
nvd.nist.gov/vuln/detail/CVE-2026-40982
github.com/advisories/GHSA-6g23-24mc-hx6x
Left out here: 21 versions. The JSON record has them.