What is the CVSS score of CVE-2026-40981?

CVE-2026-40981 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring Cloud Config are affected by CVE-2026-40981?

Spring Cloud Config versions 3.1.x through 5.0.x contain a critical information disclosure vulnerability (CVE-2026-40981, CVSS 7.5) that allows unauthenticated remote attackers to extract Google…. A patch is available.

How to fix or mitigate CVE-2026-40981?

Within 24 hours: inventory all Spring Cloud Config deployments and identify those using Google Secrets Manager as a backend; immediately isolate or disable unauthenticated access to Spring Cloud Config endpoints. Within 7 days: rotate all Google Secrets Manager credentials and service account keys potentially exposed through vulnerable instances; implement network-level access controls (WAF rules, IP whitelisting) to restrict Spring Cloud Config endpoint access. Within 30 days: upgrade to Spring Cloud Config version 5.1.0 or later when vendor patch becomes available; conduct forensic audit of GCP IAM logs for credential access anomalies; implement secret scanning and enhanced GCP project isolation policies.

Spring Cloud Config CVE-2026-40981

EUVD-2026-28245 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-07 vmware

GHSA-2mh5-3cw6-hrrq

Authentication Bypass Java Google Spring Cloud Config

7.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 07, 2026 - 06:16 EUVD

Analysis Generated

May 07, 2026 - 04:46 vuln.today

CVE Published

May 07, 2026 - 03:55 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7 maven packages depend on org.springframework.cloud:spring-cloud-config-server (6 direct, 1 indirect)

Ecosystem-wide dependent count for version 3.1.0.

DescriptionCVE.org

When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

AnalysisAI

Remote unauthenticated attackers can access Google Secrets Manager credentials from unintended GCP projects via crafted requests to Spring Cloud Config servers using Google Secrets Manager as a backend. VMware confirmed this high-severity information disclosure vulnerability (CVSS 7.5) affecting all 3.1.x through 5.0.x versions. No CISA KEV listing or public exploit code identified at time of analysis, but the network-accessible attack vector with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N) indicates straightforward exploitation once attackers identify vulnerable Spring Cloud Config deployments with Google Secrets Manager integration.

Technical ContextAI

Spring Cloud Config is a centralized configuration management server for distributed applications in Spring Boot ecosystems. When configured to use Google Secrets Manager as a secrets backend, the application retrieves credentials from GCP projects via API calls. CWE-639 (Authorization Bypass Through User-Controlled Key) indicates the vulnerability stems from insufficient validation of user-supplied input that determines which GCP project is queried. The CVSS vector shows complete confidentiality impact (C:H) with no authentication required (PR:N), meaning attackers can manipulate project identifiers or secret paths in HTTP requests to traverse across GCP project boundaries. The affected CPE identifies Spring Cloud Config across all major version branches from 3.1.0 onwards, suggesting this is a long-standing architectural issue in the Google Secrets Manager integration code rather than a recent regression.

RemediationAI

Upgrade to patched versions immediately: Spring Cloud Config 3.1.14 or greater (enterprise support only), 4.1.10 or greater (enterprise support only), 4.2.7 or greater (enterprise support only), 4.3.3 or greater, or 5.0.3 or greater. Organizations on enterprise-only branches (3.1.x, 4.1.x, 4.2.x) should contact VMware support for patch access. If immediate patching is not feasible, implement network-level access controls to restrict Config server exposure to only trusted application networks (not public internet), though this reduces but does not eliminate risk from insider threats or lateral movement scenarios. Apply GCP project-level IAM policies to limit the Config server's service account permissions to only explicitly required projects as defense-in-depth, recognizing this mitigates impact but does not fix the authorization bypass. Review Config server access logs for suspicious request patterns targeting unusual project IDs or secret paths prior to applying patches. Full remediation guidance available at https://spring.io/security/cve-2026-40981. Note that network restriction workarounds may conflict with microservices architectures requiring dynamic Config server discovery.