CVE-2026-47894 Spring Cloud Config Server Native Environment Repository Exposure
Attackers can read configuration files outside the intended repository path in Spring Cloud Config Server, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47894?
CVE-2026-47894 is a medium-severity path traversal vulnerability in Spring Cloud Config, published on 27 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier
Which versions are affected by CVE-2026-47894?
It affects 1 product.
Products include Vmware Spring Cloud Config.
How do I fix CVE-2026-47894?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-47894 being exploited?
There is no known exploitation of CVE-2026-47894 in the wild and no public exploit code.
Other vulnerabilities in Spring Cloud Config
- CVE-2020-5410 VMware Tanzu Spring Cloud Config Directory Traversal
- CVE-2026-40982 Spring Cloud Config vulnerable to Path Traversal
- CVE-2026-22739 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
- CVE-2026-40981 Spring Cloud Config has an Authorization Bypass Through User-Controlled Key
- CVE-2026-41002 Spring Cloud Config Server Susceptible To TOCTOU Attack
Sources
Also known as GHSA-xv2j-23v2-w2r5.