CVE-2026-47837 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
Attackers can access the Spring Cloud Config Server monitor endpoint without authentication, bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47837?
CVE-2026-47837 is a medium-severity missing authorization vulnerability in Spring Cloud Config, published on 26 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated.
This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.
Weakness: CWE-306
Which versions are affected by CVE-2026-47837?
It affects 1 product.
Products include Vmware Spring Cloud Config.
How do I fix CVE-2026-47837?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-47837 being exploited?
There is no known exploitation of CVE-2026-47837 in the wild and no public exploit code.
Other vulnerabilities in Spring Cloud Config
- CVE-2020-5410 VMware Tanzu Spring Cloud Config Directory Traversal
- CVE-2026-40982 Spring Cloud Config vulnerable to Path Traversal
- CVE-2026-22739 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
- CVE-2026-40981 Spring Cloud Config has an Authorization Bypass Through User-Controlled Key
- CVE-2026-41002 Spring Cloud Config Server Susceptible To TOCTOU Attack
Sources
Also known as GHSA-9w38-hp46-g6xj.