Spring Cloud Config CVE-2026-40982

Remote exploitation against default Spring Cloud Config server deployments with no authentication required. The spring-cloud-config-server module must be deployed and network-accessible to the attacker (typically listening on port 8888 or behind reverse proxy). No special configuration, user interaction, or authentication is needed - the CVSS vector PR:N confirms exploitation works against unauthenticated endpoints. Exploitation is limited by network reachability: servers deployed only within internal networks, behind VPN, or with IP whitelisting at firewall/load balancer layer reduce exposure. The vulnerability affects the server component specifically; Spring Cloud Config clients consuming configuration are not directly vulnerable through this CVE. File system permissions on the server may limit which files can be accessed via traversal, though configuration servers typically run with privileges sufficient to read sensitive application properties across the file system.

The CVSS 9.1 Critical score reflects genuine severity: network-accessible (AV:N), low attack complexity (AC:L), no authentication required (PR:N), no user interaction (UI:N), with high confidentiality and integrity impact (C:H/I:H). This combination means any internet-facing Spring Cloud Config server is potentially exploitable by unauthenticated attackers to read sensitive files. However, real-world risk depends heavily on deployment architecture - many organizations deploy Config servers only within internal networks or behind authentication layers not reflected in the application-layer CVSS score. The lack of EPSS data and absence from CISA KEV suggests no confirmed widespread exploitation at time of analysis, though this may reflect the CVE's recent publication rather than low exploitability. The vendor (VMware/Spring) has released patches across all five affected version branches, indicating they consider this a priority fix. Organizations with internet-facing Config servers or those accessible from untrusted network zones should treat this as urgent; those with Config servers isolated to trusted management networks can prioritize based on other compensating controls but should still patch during normal maintenance windows.

An attacker identifies an internet-facing Spring Cloud Config server instance through port scanning or Shodan searches for common deployment patterns (typically port 8888 or behind reverse proxy). They craft HTTP requests with path traversal sequences like 'GET /../../etc/passwd' or 'GET /../../../../application.properties' to escape the intended configuration directory. Successfully exploited, the attacker retrieves sensitive files including application secrets, database credentials stored in environment-specific configuration files, cloud provider API keys, or internal network topology information from configuration metadata. With high integrity impact noted in CVSS (I:H), attackers may also manipulate served configuration files if the traversal allows write access, potentially injecting malicious properties that execute when client applications reload configuration.