CVE-2026-41004: Spring Cloud Config Server Exposes Sensitive Information in Logs
Summary
CVE-2026-41004: Spring Cloud Config Server Logged Sensitive Information. Affects org.springframework.cloud:spring-cloud-config-server across 5 version ranges.
>= 3.1.0, <= 3.1.13
>= 4.1.0, <= 4.1.9
>= 4.2.0, <= 4.2.6
>= 4.3.0, < 4.3.3
>= 5.0.0, < 5.0.3
Fixed in 4.3.3 or 5.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Cloud Config Server is a tool that provides server-side and client-side support for externalized configuration in a distributed system. It allows applications to retrieve configuration properties from a central server, making it easier to manage configurations across multiple environments. However, certain versions of this package have a vulnerability that can expose sensitive information when trace logging is enabled.
Vulnerability Detail
The vulnerability arises from the logging mechanism in Spring Cloud Config Server, where sensitive information is logged in plain text when trace logging is enabled. This can lead to unauthorized access to sensitive data, potentially compromising the security of applications that rely on this configuration server. The affected versions include Spring Cloud Config 3.1.x (3.1.0 to 3.1.13), 4.1.x (4.1.0 to 4.1.9), 4.2.x (4.2.0 to 4.2.6), 4.3.x (4.3.0 to 4.3.2), and 5.0.x (5.0.0 to 5.0.2). The CVSS score for this vulnerability is 4.4, indicating a moderate severity level.
How To Fix
Latest published version: 5.1.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.3.0, < 4.3.34.3.3 -
>= 5.0.0, < 5.0.35.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider disabling trace logging in your Spring Cloud Config Server configuration until you can apply the necessary updates. This can be done by setting the logging level to a less verbose option in your application properties:
logging.level.org.springframework.cloud=INFO
Conclusion
In summary, the CVE-2026-41004 vulnerability in Spring Cloud Config Server can expose sensitive information through logging. It is crucial to upgrade to the patched versions to mitigate this risk. If immediate upgrades are not feasible, disabling trace logging serves as a temporary workaround.
See every vulnerability recorded for org.springframework.cloud:spring-cloud-config-server →
FAQ
The vulnerability can lead to sensitive information being logged in plain text, which may be accessed by unauthorized users.
Affected versions include 3.1.0 to 3.1.13, 4.1.0 to 4.1.9, 4.2.0 to 4.2.6, 4.3.0 to 4.3.2, and 5.0.0 to 5.0.2.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, disable trace logging as a temporary workaround to mitigate the risk.
The CVSS score for this vulnerability is 4.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.cloud:spring-cloud-config-server.
