CVE-2026-40981 Spring Cloud Config has an Authorization Bypass Through User-Controlled Key
Attackers can expose secrets from unintended GCP projects when using Google Secrets Manager backend in Spring Cloud Config.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40981?
CVE-2026-40981 is a high-severity vulnerability in Spring Cloud Config, published on 7 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Which versions are affected by CVE-2026-40981?
10 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-config-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.cloud:spring-cloud-config-server Maven | From 3.1.0 to 3.1.13 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 3.1.0 to 3.1.13 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.1.0 to 4.1.9 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.1.0 to 4.1.9 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.2.0 to 4.2.6 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.2.0 to 4.2.6 | None |
4 more packages
org.springframework.cloud:spring-cloud-config-server Maven | From 4.3.0 | 4.3.3 |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.3.0 | 4.3.3 |
org.springframework.cloud:spring-cloud-config-server Maven | From 5.0.0 | 5.0.3 |
org.springframework.cloud:spring-cloud-config-server Maven | From 5.0.0 | 5.0.3 |
Products include Vmware Spring Cloud Config.
How do I fix CVE-2026-40981?
Upgrade org.springframework.cloud:spring-cloud-config-server to a fixed version for your release line: 4.3.3 or 5.0.3.
Is CVE-2026-40981 being exploited?
There is no known exploitation of CVE-2026-40981 in the wild and no public exploit code.
Other vulnerabilities in Spring Cloud Config
- CVE-2020-5410 VMware Tanzu Spring Cloud Config Directory Traversal
- CVE-2026-40982 Spring Cloud Config vulnerable to Path Traversal
- CVE-2026-22739 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
- CVE-2026-41002 Spring Cloud Config Server Susceptible To TOCTOU Attack
- CVE-2026-47836 Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
Sources
Also known as GHSA-2mh5-3cw6-hrrq, ROOT-APP-MAVEN-CVE-2026-40981.