What is the CVSS score of EUVD-2026-28246?

EUVD-2026-28246 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Spring Cloud Config are affected by EUVD-2026-28246?

Spring Cloud Config Server versions 3.1.0-5.0.2 contain a critical directory traversal vulnerability enabling unauthenticated remote attackers to read arbitrary files from affected servers.. A patch is available.

How to fix or mitigate EUVD-2026-28246?

Within 24 hours: Identify all Spring Cloud Config Server instances in your environment and confirm versions against affected ranges (3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, 5.0.0-5.0.2). Within 7 days: Apply vendor-released patches to all affected instances-upgrade to Spring Cloud Config 3.1.14+, 4.1.10+, 4.2.7+, 4.3.3+, or 5.0.3+. Within 30 days: Conduct file access audit logs for Spring Cloud Config Server endpoints; rotate any credentials or secrets that may have been exposed through this vulnerability.

Spring Cloud Config EUVD-2026-28246

| CVE-2026-40982 CRITICAL

Path Traversal (CWE-22)

2026-05-07 vmware

GHSA-6g23-24mc-hx6x

Java Path Traversal Spring Cloud Config

9.1

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 07, 2026 - 06:16 EUVD

Analysis Generated

May 07, 2026 - 04:46 vuln.today

CVE Published

May 07, 2026 - 03:49 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.springframework.cloud:spring-cloud-config-server (5 direct, 1 indirect)

Ecosystem-wide dependent count for version 4.1.0.

DescriptionCVE.org

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

AnalysisAI

Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files from the file system using specially crafted URLs. Affects Spring Cloud Config versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2, with patches available across all branches. The vulnerability achieves CVSS 9.1 (Critical) due to remote exploitation without authentication (AV:N/AC:L/PR:N/UI:N) and high confidentiality/integrity impact, though EPSS and KEV data are not available to confirm active exploitation status. VMware/Spring has released fixes for all affected versions.

Technical ContextAI

Spring Cloud Config is a centralized configuration management service for distributed systems, commonly used in Spring Boot microservices architectures. The spring-cloud-config-server module serves configuration files (text and binary) to client applications. This vulnerability is a classic path traversal (CWE-22) flaw where insufficient validation of user-supplied input in URL paths allows attackers to navigate outside intended directory boundaries using sequences like '../' or encoded equivalents. The CPE identifier (cpe:2.3:a:spring:spring_cloud_config) confirms this is specific to the Spring Cloud Config library itself, not the broader Spring Framework. Path traversal in configuration servers is particularly severe because these systems often have access to sensitive application properties, credentials, database connection strings, and API keys stored in configuration files across the file system.

RemediationAI

Upgrade to patched versions immediately: Spring Cloud Config 3.1.14+ (Enterprise Support only), 4.1.10+ (Enterprise Support only), 4.2.7+ (Enterprise Support only), 4.3.3+, or 5.0.3+. Vendor advisory with exact fix versions available at https://spring.io/security/cve-2026-40982. For organizations unable to patch immediately, implement network-level compensating controls: restrict Spring Cloud Config server access to trusted IP ranges via firewall rules, place servers behind VPN or bastion hosts requiring authentication, or deploy Web Application Firewall (WAF) rules to block requests containing path traversal sequences (../, encoded variants like %2e%2e%2f, and absolute path references). Note that WAF-based filtering may cause false positives if legitimate configuration file names contain these patterns and requires ongoing maintenance. The most robust mitigation is upgrading to patched versions, as path traversal vulnerabilities are difficult to comprehensively block at network layer without breaking legitimate functionality.