Vulnerability Directory | CVE-2026-40982 | Spring

Overview

Spring Cloud Config is a centralized configuration management tool for distributed systems built on the Spring Framework. The spring-cloud-config-server module exposes HTTP endpoints that serve configuration data and arbitrary text or binary files to client applications, backed by Git, native filesystem, Vault, JDBC, and other repositories.

A critical-severity vulnerability (CVE-2026-40982) has been identified in Spring Cloud Config Server's file-serving controllers (ResourceController, EnvironmentController, and EncryptionController). Three URL-bound parameters used to compose backend lookups, profile, path, and (on the encrypt and decrypt endpoints) name and profiles, were either entirely unvalidated or guarded only by a permissive deny-list. An unauthenticated remote attacker can submit a specially crafted URL whose profile, path, or name segment smuggles a directory-traversal sequence past the existing decoder, causing the server to resolve a file outside of the configured search location and return its contents (or, depending on backend semantics, influence what is read or written).

Per OWASP: "A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with 'dot-dot-slash (../)' sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system."

This issue affects Spring Cloud Config >=1.0.0 <=3.1.13, >=4.1.0 <=4.1.9, >=4.2.0 <=4.2.6, >=4.3.0 <=4.3.2, and >=5.0.0 <=5.0.2.

‍

Details

Module Info

Product: Spring Cloud Config
Affected packages: spring-cloud-config-server
Affected versions: >=1.0.0 <=3.1.13, >=4.1.0 <=4.1.9, >=4.2.0 <=4.2.6, >=4.3.0 <=4.3.2, >=5.0.0 <=5.0.2
GitHub repository: https://github.com/spring-cloud/spring-cloud-config
Published packages: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-config-server
Package manager: Maven
Fixed in:
- NES for Spring Cloud Config 3.0.x, 3.1.x, 4.1.x, 4.2.x
- OSS Spring Cloud Config 4.3.3, 5.0.3

Vulnerability Info

Spring Cloud Config Server processes configuration and file access requests through multiple controller endpoints that ultimately resolve user-supplied path components against a backend repository. The URL templates of controllers expose path components that are eventually composed into a backend lookup against the configured repository, which for the native and Git backends resolves to a java.io.File or a Spring Resource under a search-location root.

Three earlier CVEs (CVE-2020-5405, CVE-2020-5410, CVE-2026-22739) progressively added directory-traversal protection to name, label, and profile in EnvironmentController and ResourceController. Those fixes left two gaps that CVE-2026-40982 closes by introducing more robust input validation and normalization:

Request parameters involved in repository resolution are now uniformly normalized and validated.
Validation has been enhanced to enforce stricter character constraints, replacing earlier pattern-based checks that could be bypassed under certain conditions.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (base score 9.4) reflects that the attack is unauthenticated, network-reachable, and yields high confidentiality and integrity impact with no service-availability effect.

The vulnerable controllers have existed since the Spring Cloud Config 1.0 line. Path-traversal protection on individual parameters was added incrementally by the three earlier CVEs cited above, but the path parameter and the profile allow-list were never tightened until April 2026, which is why every Spring Cloud Config Server release prior to the fix is affected. The advisory's listed range starting at 3.1.x reflects Spring's currently-supported scope; older lines, including the lines covered by NES support, are also in scope.

‍

Mitigation

Only recent versions of Spring Cloud Config receive community support and updates. Older versions have no publicly available fixes for this vulnerability.

Users of the affected components should apply one of the following mitigations:

Upgrade to a currently supported version of Spring Cloud Config. The OSS fix ships in Spring Cloud Config 4.3.3 (4.3.x line) and 5.0.3 (5.0.x line).
Leverage a commercial support partner like HeroDevs for post-EOL security support through Never-Ending Support (NES) for Spring Cloud Config.

‍