Critical

Directory Traversal in Spring Cloud Config Server

IdentifiersCVE-2026-40982CWE-22· Improper Limitation of a Pathname…

CVE-2026-40982 is a critical directory traversal vulnerability in the spring-cloud-config-server module of Spring Cloud Config. The flaw is caused by insufficient sanitization and validation of file paths derived from URL parameters in request-handling logic used to serve text and binary files. By sending a specially crafted HTTP request containing path traversal sequences, an attacker can cause the server to resolve and return files outside the intended directory structure. The issue affects Spring Cloud Config 3.1.0 through 3.1.13, 4.1.0 through 4.1.9, 4.2.0 through 4.2.6, 4.3.0 through 4.3.2, and 5.0.0 through 5.0.2.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files from the underlying host and potentially from locations accessible through configured backends. Exposed material may include database credentials, API keys, internal service configuration, and other secrets. The provided context also states high integrity impact in the advisory/CVSS assessment, particularly because Spring Cloud Config commonly acts as a centralized configuration service for distributed microservices, increasing downstream exposure if sensitive configuration data is disclosed or abused. No availability impact is indicated in the supplied material.

Mitigation

If you can’t patch tonight, do this now.

The provided content states that no configuration workaround is documented and that upgrading to a fixed supported release is the only officially supported mitigation.

Remediation

Patch, then assume compromise.

Upgrade Spring Cloud Config to a fixed release in the relevant branch: 3.1.14 or later, 4.1.10 or later, 4.2.7 or later, 4.3.3 or later, or 5.0.3 or later. Per the provided content, fixes for 3.1.14, 4.1.10, and 4.2.7 are Enterprise Support Only; open-source users should upgrade to a supported fixed release such as 4.3.3 or 5.0.3 where applicable.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

BroadcomSpring Cloud Configapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

cyber security newsNews

May 8, 2026

Critical Spring Vulnerabilities Expose Arbitrary Files and GCP Secrets

A critical directory traversal vulnerability in Spring Cloud Config Server that allows attackers to access arbitrary files on the host via crafted URLs.

ca ccsNews

May 7, 2026

Spring security advisory (AV26-431) - Canadian Centre for Cyber Security

A directory traversal vulnerability affecting Spring Cloud Config Server.

cvefeed high severityNews

May 7, 2026

CVE-2026-40982 - Spring Cloud Config Directory Traversal Vulnerability

A directory traversal vulnerability in Spring Cloud Config's spring-cloud-config-server module that can allow a remote attacker to retrieve arbitrary text and binary files via a specially crafted URL.

zeropath blogNews

May 6, 2026

Brief Summary: CVE-2026-40982 Directory Traversal in Spring Cloud Config Server - ZeroPath Blog | ZeroPath

A critical directory traversal vulnerability in Spring Cloud Config Server that allows unauthenticated remote attackers to read arbitrary files from the underlying host via crafted HTTP requests.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity8

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-40982

NVD

nvd.nist.gov/vuln/detail/CVE-2026-40982

MITRE CWE · CWE-22

Improper Limitation of a Pathname to a…

Vendor Advisory

spring.io/security/cve-2026-40982