CVE-2026-40981: spring spring cloud config
Vulnerability summary
CVE-2026-40981 is a high (CVSS 7.5) vulnerability in spring spring cloud config. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.1% of scored vulnerabilities.
Timeline
- 07-05-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
+0.05 pp
From 0.43% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- CWE-1220Insufficient Granularity of Access ControlThe product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
Affected systems
Org.springframework.cloud1 product
- spring-cloud-config-server≥ 3.1.0, ≤ 3.1.13 | ≥ 4.1.0, ≤ 4.1.9 | ≥ 4.2.0, ≤ 4.2.6 | ≥ 4.3.0, < 4.3.3 | ≥ 5.0.0, < 5.0.3
Spring1 product
- spring cloud config≥ 3.1.0, < 3.1.14 | ≥ 4.1.0, < 4.1.10 | ≥ 4.2.0, < 4.2.7 | ≥ 4.3.0, < 4.3.3 | ≥ 5.0.0, < 5.0.3
Vmware1 product
- spring_cloud_config≥ 3.1.0, < 3.1.14 | ≥ 4.1.0, < 4.1.10 | ≥ 4.2.0, < 4.2.7 | ≥ 4.3.0, < 4.3.3 | ≥ 5.0.0, < 5.0.3
3 vendors · 3 products
