CVE-2026-40982 Spring Cloud Config vulnerable to Path Traversal
Attackers can read arbitrary files via directory traversal in Spring Cloud Config, requiring an upgrade to secure the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40982?
CVE-2026-40982 is a critical path traversal vulnerability in Spring Cloud Config, published on 7 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Weakness: CWE-22
Which versions are affected by CVE-2026-40982?
10 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-config-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.cloud:spring-cloud-config-server Maven | All versions to 3.1.13 | None |
org.springframework.cloud:spring-cloud-config-server Maven | All versions to 3.1.13 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.1.0 to 4.1.9 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.1.0 to 4.1.9 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.2.0 to 4.2.6 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.2.0 to 4.2.6 | None |
4 more packages
org.springframework.cloud:spring-cloud-config-server Maven | From 4.3.0 | 4.3.3 |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.3.0 | 4.3.3 |
org.springframework.cloud:spring-cloud-config-server Maven | From 5.0.0 | 5.0.3 |
org.springframework.cloud:spring-cloud-config-server Maven | From 5.0.0 | 5.0.3 |
Products include Vmware Spring Cloud Config.
How do I fix CVE-2026-40982?
Upgrade org.springframework.cloud:spring-cloud-config-server to a fixed version for your release line: 4.3.3 or 5.0.3.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-40982 being exploited?
There is no known exploitation of CVE-2026-40982 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Spring Cloud Config
- CVE-2020-5410 VMware Tanzu Spring Cloud Config Directory Traversal
- CVE-2026-22739 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
- CVE-2026-40981 Spring Cloud Config has an Authorization Bypass Through User-Controlled Key
- CVE-2026-41002 Spring Cloud Config Server Susceptible To TOCTOU Attack
- CVE-2026-47836 Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
Sources
Also known as GHSA-6g23-24mc-hx6x, ROOT-APP-MAVEN-CVE-2026-40982.