Introduction
A directory traversal flaw in Spring Cloud Config Server lets unauthenticated attackers read arbitrary files from the underlying host with a single crafted HTTP request. Spring Cloud Config is typically the central configuration store for a distributed microservice architecture, so successful exploitation could expose database credentials, API keys, and internal service configurations across an entire deployment.
Technical Information
CVE-2026-40982 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly called Path Traversal. The vulnerability is in the spring-cloud-config-server module, which is built to serve arbitrary text and binary files to client applications. For binary files, the server expects an Accept header of application/octet-stream. The server can work with several backend types, including Git, SVN, and native file systems.
Root Cause
The server does not sufficiently sanitize file paths in incoming requests. The Config Server exposes endpoints that resolve file paths from URL parameters. When an attacker puts path traversal sequences into a specially crafted URL, the server resolves the path outside its intended directory structure, and the attacker can reach files elsewhere on the filesystem.
CVSS Breakdown
VMware assigned the CVSS v3.1 vector string AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which gives a base score of 9.1 (Critical).
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector | Network | Exploitable remotely |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | None | No authentication needed |
| User Interaction | None | No victim action required |
| Confidentiality Impact | High | Arbitrary file read |
| Integrity Impact | High | Potential to influence served configurations |
| Availability Impact | None | Service remains operational |
Network access, no authentication, and low complexity together make this vulnerability especially dangerous in any environment where the Config Server is reachable from untrusted networks.
Attack Flow
Based on the advisory details, exploitation is straightforward:
- The attacker finds a Spring Cloud Config Server instance. These typically listen on a known port and expose predictable endpoint patterns.
- The attacker builds a URL with path traversal sequences that point at a sensitive file, such as a configuration file containing credentials or a system file.
- The attacker sends the crafted request to the Config Server. For binary content, the request may include an
Accept: application/octet-streamheader, depending on the target file type. - The server does not properly validate the path, so it resolves the traversal sequences and returns the contents of the requested file.
- The file contents come back in the HTTP response. They may include secrets, credentials, or other sensitive data managed by the Config Server or stored on the host filesystem.
Because the Config Server often has read access to Git repositories, SVN repositories, or local filesystem directories containing application secrets, the blast radius of this vulnerability extends well beyond the server itself.
Affected Systems and Versions
The following Spring Cloud Config release trains are affected:
| Release Train | Vulnerable Versions | Fixed Version | Availability |
|---|---|---|---|
| 3.1.x | 3.1.0 through 3.1.13 (inclusive) | 3.1.14 | Enterprise Support Only |
| 4.1.x | 4.1.0 through 4.1.9 (inclusive) | 4.1.10 | Enterprise Support Only |
| 4.2.x | 4.2.0 through 4.2.6 (inclusive) | 4.2.7 | Enterprise Support Only |
| 4.3.x | 4.3.0 through 4.3.2 (inclusive) | 4.3.3 | Open Source |
| 5.0.x | 5.0.0 through 5.0.2 (inclusive) | 5.0.3 | Open Source |
Older, unsupported versions of Spring Cloud Config are also affected. Organizations running versions outside the listed trains should assume they are vulnerable and migrate to a supported release immediately.
Fixes for the 3.1.x, 4.1.x, and 4.2.x branches are available only through VMware Tanzu Spring Enterprise Support. Organizations on those older branches without an enterprise contract will need to upgrade to the 4.3.x or 5.0.x trains to get the fix through open source channels.
The vendor advisory documents no configuration workarounds, so a version upgrade is the only officially supported remediation path.
Vendor Security History
Spring Cloud Config is part of the Spring ecosystem, now managed by VMware, which has been a Broadcom division since the November 2023 acquisition. VMware maintains a dedicated security advisory page at spring.io/security and follows a structured disclosure and patching process. The tiered support model, which gates fixes for older branches behind enterprise contracts, has become more pronounced since the Broadcom acquisition. It leaves a practical gap for organizations on older open source deployments that need security patches but have no enterprise support agreement.
References
- Spring Security Advisory: CVE-2026-40982
- NVD Entry: CVE-2026-40982
- Spring Cloud Config Documentation
- Spring Cloud Config: Serving Binary Files
- Spring Cloud Config: File System Backend
- VMware Tanzu Spring
- Spring Security Advisories Archive
- Security Next (Japanese): Spring Cloud Config Path Traversal Report
