CVE-2026-41004 Spring Cloud Config Server Logged Sensitive Information
Enabling trace logging exposes sensitive configuration data in plain text, requiring an upgrade to prevent information leakage.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41004?
CVE-2026-41004 is a medium-severity vulnerability in Spring Cloud Config, published on 7 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Weakness: CWE-532
Which versions are affected by CVE-2026-41004?
12 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-config-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.cloud:spring-cloud-config-server Maven | From 3.0.0 to 3.0.7 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 3.0.0 to 3.0.7 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 3.1.0 to 3.1.13 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 3.1.0 to 3.1.13 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.1.0 to 4.1.9 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.1.0 to 4.1.9 | None |
6 more packages
org.springframework.cloud:spring-cloud-config-server Maven | From 4.2.0 to 4.2.6 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.2.0 to 4.2.6 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.3.0 | 4.3.3 |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.3.0 | 4.3.3 |
org.springframework.cloud:spring-cloud-config-server Maven | From 5.0.0 | 5.0.3 |
org.springframework.cloud:spring-cloud-config-server Maven | From 5.0.0 | 5.0.3 |
Products include Vmware Spring Cloud Config.
How do I fix CVE-2026-41004?
Upgrade org.springframework.cloud:spring-cloud-config-server to a fixed version for your release line: 4.3.3 or 5.0.3.
Is CVE-2026-41004 being exploited?
There is no known exploitation of CVE-2026-41004 in the wild and no public exploit code.
Other vulnerabilities in Spring Cloud Config
- CVE-2020-5410 VMware Tanzu Spring Cloud Config Directory Traversal
- CVE-2026-40982 Spring Cloud Config vulnerable to Path Traversal
- CVE-2026-22739 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
- CVE-2026-40981 Spring Cloud Config has an Authorization Bypass Through User-Controlled Key
- CVE-2026-41002 Spring Cloud Config Server Susceptible To TOCTOU Attack
Sources
Also known as GHSA-j6hh-h3cf-c2hf.