EUVD-2026-66638
GHSA-9w38-hp46-g6xj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Config Server /monitor endpoint
-
DeliveryCraft forged SCM webhook request
-
ExploitPOST unauthenticated to /monitor
-
ExecutionServer processes fake change event
-
PersistBroadcast refresh across clients
-
ImpactConfiguration state disruption
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target run Spring Cloud Config Server with the spring-cloud-config-monitor component enabled (which exposes the /monitor endpoint) and that the endpoint be network-reachable by the attacker. Per CVSS AV:N/AC:L/PR:N/UI:N no authentication or user interaction is needed once /monitor is reachable, so on a Config Server that exposes /monitor to an untrusted network there are no special conditions. Limiting factors: the config-monitor module is optional and not always deployed, well-run deployments keep the Config Server on internal networks or behind authenticating gateways, and CISA SSVC rates the impact as only partial, so realistic effect is forced configuration refresh rather than full system takeover. |
| Impact | The signals conflict and should be reconciled before prioritization. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) implies unauthenticated network-wide critical impact, but CISA's SSVC framework rates Exploitation as none, Automatable as no, and Technical Impact as only partial, and EPSS is low at 0.28% (20th percentile). The realistic impact of an unauthenticated /monitor call is to force configuration-refresh events, which is closer to an integrity/availability nuisance than the full confidentiality-integrity-availability compromise the 9.8 suggests - the C:H/I:H/A:H triad appears overstated relative to SSVC's 'partial' impact. Additionally, exploitation is gated on the config-monitor component being enabled and the endpoint being network-reachable, which is not the default for every Spring Cloud Config deployment. Net: patch on a normal cadence rather than as an emergency, unless your Config Server exposes /monitor to untrusted networks. No active exploitation and no POC are reported. |
| Exploit ScenarioDerived | An attacker who can reach a Spring Cloud Config Server exposed on the network sends a forged webhook POST to /monitor without any credentials, causing the server to process the fake change notification and broadcast configuration-refresh events to downstream client applications. Repeated forged calls could be used to disrupt configuration state or trigger unwanted refresh activity across the microservice fleet. No public POC is currently available, and the network vector with low complexity (AV:N/AC:L) makes the request itself trivial to craft. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 04, 2026
Missing authentication on Spring Cloud Config Server's /monitor endpoint lets remote attackers submit unvalidated webhook requests, forcing configuration-refresh events without any credentials. It affects Spring Cloud Config 3.x through 3.1.14, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4, and is exploitable only when the spring-cloud-config-monitor component is enabled. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile) and CISA SSVC rates exploitation as none and technical impact as only partial, tempering the vendor's 9.8 rating.
Earlier versions of this analysis (1)
Unauthenticated webhook requests can be sent to Spring Cloud Config Server's /monitor endpoint due to missing validation of incoming webhook payloads, enabling any network-accessible attacker to trigger configuration refresh events across connected microservices. Affected are all branches including 3.x through 3.1.14, 4.0.x through 4.2.8, 4.3.x through 4.3.4, and 5.0.x through 5.0.4 - a broad spread across major release lines. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the network-accessible, authentication-free nature of the flaw lowers the exploitation bar considerably for attackers who can reach the config server.
RemediationAI
Upgrade to a fixed release above the affected ranges - the vendor advisory (https://spring.io/security/cve-2026-47837) is the authoritative source for the exact patched versions; based on the affected ranges the fixed lines are the next releases after 5.0.4, 4.3.4, 4.2.8, and 3.1.14, but confirm the precise fix version against the Spring advisory before deploying rather than assuming a number. As compensating controls where immediate patching is not possible: restrict network access to the /monitor endpoint so only your SCM provider's webhook source IP ranges can reach it (trade-off: breaks refresh if SCM egress IPs change or are undocumented); place the Config Server behind an authenticating reverse proxy or gateway and require a shared secret/signature on webhook calls (trade-off: your SCM must be configured to send it); or disable spring-cloud-config-monitor entirely if automatic push-refresh is not required (trade-off: clients must poll or be refreshed manually). Ensure the Config Server is never exposed directly to the public internet.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Spring Cloud Config is a VMware/Spring Java library that centralizes externalized configuration for distributed microservices, serving property sources from a Git/SCM backend to client applications. The optional spring-cloud-config-monitor module exposes a /monitor endpoint designed to receive push webhooks from SCM providers (GitHub, GitLab, Bitbucket, etc.) so the server can detect changed files and broadcast a RefreshRemoteApplicationEvent to refresh clients. The root cause is CWE-306 (Missing Authentication for Critical Function): the endpoint accepts and acts on webhook payloads without validating that the caller is a legitimate SCM source, so any party who can reach the endpoint can trigger this critical refresh function. CPE cpe:2.3:a:spring:spring_cloud_config identifies the affected library.
Know when Spring gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network call with low complexity, but forced config-refresh yields limited integrity/availability impact and no direct confidentiality loss, matching SSVC 'partial'.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated.
This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.
Executive ViewAI
Spring Cloud Config Server (versions 3.x-5.0.4) is vulnerable to remote configuration tampering when the spring-cloud-config-monitor component is enabled. An attacker can bypass authentication on the webhook endpoint to force configuration reloads across connected applications, potentially leading to data theft, unauthorized access, or service disruption. Organizations should immediately identify affected deployments and implement interim protections, as no patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the spring-cloud-config-monitor component if not operationally required; (2) Implement network segmentation and deploy API gateway authentication to restrict /monitor endpoint access to trusted sources only; (3) Enable comprehensive audit logging for all configuration refresh events and implement alerting on configuration changes; (4) Establish configuration validation and rollback procedures to detect and reject unauthorized or malicious configurations; (5) Use external secrets management tools to reduce reliance on configuration server for sensitive data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. Rated critical severi
Access control bypass in SpringBlade v4.5.0 importUser function allows low-privileged users to import sensitive user dat
Spring Cloud Config Server contains a path traversal vulnerability when using the native file system backend, allowing u
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant
SpringBlade v4.5.0 has an access control flaw in authRoutes allowing low-privileged users to escalate to admin through t
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated at
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across
Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Sprin
Unsafe JSON deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJso
Spring Security Aspects may not correctly locate method security annotations on private methods. Rated critical severity
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input esca
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files
Exploit-DB