VMware Spring Cloud Config vulnerabilities

13 CVEs affecting VMware Spring Cloud Config, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59315, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-5410: VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability, published 2020-06-02. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 95.6% chance of exploitation in the next 30 days. Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the…
CVE-2019-3799, published 2019-05-06. Medium severity, CVSS 6.5. EPSS: 85.3% chance of exploitation in the next 30 days. Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary…
CVE-2020-5405, published 2020-03-05. Medium severity, CVSS 6.5. EPSS: 68.5% chance of exploitation in the next 30 days. Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the…
CVE-2026-22739, published 2026-03-24. High severity, CVSS 8.6. EPSS: 1.2% chance of exploitation in the next 30 days. Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible…
CVE-2026-40982, published 2026-05-07. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially…
CVE-2026-47837, published 2026-08-26. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue…
CVE-2026-47894, published 2026-08-27. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0…
CVE-2026-40981, published 2026-05-07. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring…
CVE-2026-59315, published 2026-08-27. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 -…
CVE-2023-20859, published 2023-03-23. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it…

Latest

CVE-2026-47836, published 2026-08-26. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring…
CVE-2026-41004, published 2026-05-07. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive);…
CVE-2026-41002, published 2026-05-07. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring…