CVE-2026-40982 - Vulnerability Analysis

Overview

Spring Cloud Config 3.1.0 to 3.1.13, 4.1.0 to 4.1.9, 4.2.0 to 4.2.6, 4.3.0 to 4.3.2, and 5.0.0 to 5.0.2 contain a path traversal caused by specially crafted URL requests in spring-cloud-config-server, letting attackers access arbitrary files remotely, exploit requires no special privileges.

Severity & Score

Impact

Attackers can access arbitrary files on the server, potentially exposing sensitive information.

Mitigation

Upgrade to 3.1.14, 4.1.10, 4.2.7, 4.3.3, or 5.0.3 or greater.

References

• https://spring.io/security/cve-2026-40982

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner