CVE-2026-40982: Spring Cloud Config Path Traversal Vulnerability
Summary
CVE-2026-40982: Spring Cloud Config vulnerable to Path Traversal. Affects org.springframework.cloud:spring-cloud-config-server across 5 version ranges.
>= 3.1.0, <= 3.1.13
>= 4.1.0, <= 4.1.9
>= 4.2.0, <= 4.2.6
>= 4.3.0, < 4.3.3
>= 5.0.0, < 5.0.3
Fixed in 4.3.3 or 5.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Cloud Config is a powerful tool that enables applications to serve configuration files from a central server. It supports both text and binary files, allowing for seamless configuration management across distributed systems. However, due to its design, it is susceptible to security vulnerabilities, particularly those that can be exploited through crafted URLs, leading to unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability identified as CVE-2026-40982 in Spring Cloud Config arises from its ability to serve arbitrary files through the spring-cloud-config-server module. An attacker can exploit this by crafting a malicious URL that triggers a directory traversal attack, allowing them to access files outside the intended directory. This can lead to exposure of sensitive information, including configuration files and other critical data. The vulnerability affects multiple versions of the package, making it imperative for users to take immediate action to secure their applications.
How To Fix
Latest published version: 5.1.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.3.0, < 4.3.34.3.3 -
>= 5.0.0, < 5.0.35.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Spring Cloud Config Server by implementing network-level security measures, such as firewalls or VPNs, to limit exposure to untrusted networks until the upgrade can be completed.
Conclusion
CVE-2026-40982 represents a significant security risk for applications using Spring Cloud Config. It is crucial for users to upgrade to the latest patched versions to mitigate the risk of directory traversal attacks. By following the recommended steps and utilizing tools like Vulert, developers can ensure their applications remain secure.
See every vulnerability recorded for org.springframework.cloud:spring-cloud-config-server →
FAQ
CVE-2026-40982 is a critical vulnerability in Spring Cloud Config that allows for directory traversal attacks, potentially exposing sensitive files.
Versions 3.1.0 to 3.1.13, 4.1.0 to 4.1.9, 4.2.0 to 4.2.6, 4.3.0 to 4.3.2, and 5.0.0 to 5.0.2 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score for CVE-2026-40982 is 9.1, indicating a critical level of severity.
If immediate upgrading is not possible, implement network-level security measures to restrict access to the Spring Cloud Config Server as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.cloud:spring-cloud-config-server.
