Vulnerability-Lookup

CVE-2026-40981 (GCVE-0-2026-40981)

Vulnerability from cvelistv5 – Published: 2026-05-07 03:55 – Updated: 2026-06-30 12:08

Summary

When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-1220 - Insufficient Granularity of Access Control

Assigner

vmware

References

4 references

URL	Tags
https://spring.io/security/cve-2026-40981
https://access.redhat.com/security/cve/CVE-2026-40981	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2467621	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

3 products

Vendor	Product	Version
Spring	Spring Cloud Config	Affected: 3.1.0 , < 3.1.14 (custom) Affected: 4.1.0 , < 4.1.10 (custom) Affected: 4.2.0 , < 4.2.7 (custom) Affected: 4.3.0 , < 4.3.3 (custom) Affected: 5.0.0 , < 5.0.3 (custom)
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40981",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-07T12:57:24.983565Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-07T12:57:35.373Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-07T03:55:43.600Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Spring Cloud Config. When utilizing Google Secrets Manager as a backend, a remote client can craft a specific request to the config server. This action may lead to the unintended exposure of secrets from other Google Cloud Platform (GCP) projects, resulting in sensitive information disclosure."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1220",
                "description": "Insufficient Granularity of Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T12:08:52.892Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-40981"
          },
          {
            "name": "RHBZ#2467621",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467621"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40981.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-07T05:01:29.073Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-07T03:55:43.600Z",
            "value": "Made public."
          }
        ],
        "title": "Spring Cloud Config: Spring Cloud Config: Information disclosure of secrets from unintended GCP projects",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Config",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "3.1.14",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.10",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.7",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.3",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.0.3",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.\nSpring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater."
            }
          ],
          "value": "When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.\nSpring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An unauthenticated remote attacker can craft a request to the Config Server to expose sensitive secrets from unintended GCP projects, compromising the confidentiality of data managed by the server."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-07T03:55:43.600Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-40981"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-40981",
    "datePublished": "2026-05-07T03:55:43.600Z",
    "dateReserved": "2026-04-16T02:19:04.616Z",
    "dateUpdated": "2026-06-30T12:08:52.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-40981",
      "date": "2026-07-01",
      "epss": "0.00435",
      "percentile": "0.34923"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-40981\",\"sourceIdentifier\":\"security@vmware.com\",\"published\":\"2026-05-07T04:16:24.607\",\"lastModified\":\"2026-06-30T03:19:22.117\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.\\nSpring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.\"}],\"affected\":[{\"source\":\"security@vmware.com\",\"affectedData\":[{\"vendor\":\"Spring\",\"product\":\"Spring Cloud Config\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.1.0\",\"lessThan\":\"3.1.14\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.1.0\",\"lessThan\":\"4.1.10\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.2.0\",\"lessThan\":\"4.2.7\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.3.0\",\"lessThan\":\"4.3.3\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.0.0\",\"lessThan\":\"5.0.3\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-07T12:57:24.983565Z\",\"id\":\"CVE-2026-40981\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-639\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1220\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.1.0\",\"versionEndExcluding\":\"3.1.14\",\"matchCriteriaId\":\"A35B9ECF-3B4A-4E35-8CDE-54EC21E723DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.1.0\",\"versionEndExcluding\":\"4.1.10\",\"matchCriteriaId\":\"446B9053-153B-41E3-A339-C216572E5450\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2.0\",\"versionEndExcluding\":\"4.2.7\",\"matchCriteriaId\":\"2B36B389-41C0-400D-BA92-F5905C9BEBFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.3.0\",\"versionEndExcluding\":\"4.3.3\",\"matchCriteriaId\":\"5E965315-4507-461D-979F-D5F5602EC8D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0.0\",\"versionEndExcluding\":\"5.0.3\",\"matchCriteriaId\":\"218A144D-2CDA-4873-899C-7D8718D5601F\"}]}]}],\"references\":[{\"url\":\"https://spring.io/security/cve-2026-40981\",\"source\":\"security@vmware.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-40981\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2467621\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40981.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-40981\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-07T12:57:24.983565Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-07T12:57:29.249Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"An unauthenticated remote attacker can craft a request to the Config Server to expose sensitive secrets from unintended GCP projects, compromising the confidentiality of data managed by the server.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Spring\", \"product\": \"Spring Cloud Config\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.1.0\", \"lessThan\": \"3.1.14\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.1.0\", \"lessThan\": \"4.1.10\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.2.0\", \"lessThan\": \"4.2.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.0\", \"lessThan\": \"4.3.3\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.0.0\", \"lessThan\": \"5.0.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://spring.io/security/cve-2026-40981\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.\\nSpring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.\\nSpring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"shortName\": \"vmware\", \"dateUpdated\": \"2026-05-07T03:55:43.600Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-40981\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-07T12:57:35.373Z\", \"dateReserved\": \"2026-04-16T02:19:04.616Z\", \"assignerOrgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"datePublished\": \"2026-05-07T03:55:43.600Z\", \"assignerShortName\": \"vmware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0543

Vulnerability from certfr_avis - Published: 2026-05-07 - Updated: 2026-05-07

De multiples vulnérabilités ont été découvertes dans Spring Cloud Config. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Spring	Cloud Config	Cloud Config versions 4.3.x antérieures à 4.3.3
Spring	Cloud Config	Cloud Config versions 4.2.x antérieures à 4.2.7
Spring	Cloud Config	Cloud Config versions 5.0.x antérieures à 5.0.3
Spring	Cloud Config	Cloud Config versions 4.1.x antérieures à 4.1.10
Spring	Cloud Config	Cloud Config versions antérieures à 3.1.14

References

Title

Publication Time

FKIE_CVE-2026-40981

Vulnerability from fkie_nvd - Published: 2026-05-07 04:16 - Updated: 2026-06-30 03:19

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security@vmware.com	https://spring.io/security/cve-2026-40981	Vendor Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/security/cve/CVE-2026-40981
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://bugzilla.redhat.com/show_bug.cgi?id=2467621
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40981.json

Impacted products

Vendor	Product	Version
vmware	spring_cloud_config	*
vmware	spring_cloud_config	*
vmware	spring_cloud_config	*
vmware	spring_cloud_config	*
vmware	spring_cloud_config	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Config",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "3.1.14",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.10",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.7",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.3",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.0.3",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@vmware.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "vendor": "Red Hat"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A35B9ECF-3B4A-4E35-8CDE-54EC21E723DB",
              "versionEndExcluding": "3.1.14",
              "versionStartIncluding": "3.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "446B9053-153B-41E3-A339-C216572E5450",
              "versionEndExcluding": "4.1.10",
              "versionStartIncluding": "4.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B36B389-41C0-400D-BA92-F5905C9BEBFD",
              "versionEndExcluding": "4.2.7",
              "versionStartIncluding": "4.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E965315-4507-461D-979F-D5F5602EC8D3",
              "versionEndExcluding": "4.3.3",
              "versionStartIncluding": "4.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "218A144D-2CDA-4873-899C-7D8718D5601F",
              "versionEndExcluding": "5.0.3",
              "versionStartIncluding": "5.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.\nSpring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater."
    }
  ],
  "id": "CVE-2026-40981",
  "lastModified": "2026-06-30T03:19:22.117",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security@vmware.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40981",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-07T12:57:24.983565Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-07T04:16:24.607",
  "references": [
    {
      "source": "security@vmware.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://spring.io/security/cve-2026-40981"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/security/cve/CVE-2026-40981"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467621"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40981.json"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security@vmware.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1220"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary"
    }
  ]
}

GHSA-2MH5-3CW6-HRRQ

Vulnerability from github – Published: 2026-05-07 06:31 – Updated: 2026-06-11 14:48

Summary

Spring Cloud Config has an Authorization Bypass Through User-Controlled Key

Details

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.cloud:spring-cloud-config-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "last_affected": "3.1.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.cloud:spring-cloud-config-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "last_affected": "4.1.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.cloud:spring-cloud-config-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "last_affected": "4.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.3.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.cloud:spring-cloud-config-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.3.0"
            },
            {
              "fixed": "4.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.cloud:spring-cloud-config-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40981"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-11T16:19:03Z",
    "nvd_published_at": "2026-05-07T04:16:24Z",
    "severity": "HIGH"
  },
  "details": "When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.\nSpring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.",
  "id": "GHSA-2mh5-3cw6-hrrq",
  "modified": "2026-06-11T14:48:18Z",
  "published": "2026-05-07T06:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40981"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spring-cloud/spring-cloud-config"
    },
    {
      "type": "WEB",
      "url": "https://spring.io/security/cve-2026-40981"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spring Cloud Config has an Authorization Bypass Through User-Controlled Key "
}

WID-SEC-W-2026-1399

Vulnerability from csaf_certbund - Published: 2026-05-06 22:00 - Updated: 2026-05-06 22:00

Summary

VMware Tanzu Spring Cloud Config: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: VMware Tanzu Spring Cloud ist eine Plattform zur Bereitstellung und Verwaltung von Spring-Anwendungen in Cloud-Umgebungen unter Verwendung von Microservices-Architekturen.

Angriff: Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Cloud Config ausnutzen, um vertrauliche Informationen offenzulegen oder Daten zu manipulieren.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2026-41002

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
VMware Tanzu Spring Cloud Config OSS <4.3.3 VMware Tanzu / Spring Cloud		Config OSS <4.3.3
VMware Tanzu Spring Cloud Config OSS <5.0.3 VMware Tanzu / Spring Cloud		Config OSS <5.0.3
VMware Tanzu Spring Cloud Config <4.1.10 VMware Tanzu / Spring Cloud		Config <4.1.10
VMware Tanzu Spring Cloud Config <4.2.7 VMware Tanzu / Spring Cloud		Config <4.2.7
VMware Tanzu Spring Cloud Config <3.1.14 VMware Tanzu / Spring Cloud		Config <3.1.14

CVE-2026-41004

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
VMware Tanzu Spring Cloud Config OSS <4.3.3 VMware Tanzu / Spring Cloud		Config OSS <4.3.3
VMware Tanzu Spring Cloud Config OSS <5.0.3 VMware Tanzu / Spring Cloud		Config OSS <5.0.3
VMware Tanzu Spring Cloud Config <4.1.10 VMware Tanzu / Spring Cloud		Config <4.1.10
VMware Tanzu Spring Cloud Config <4.2.7 VMware Tanzu / Spring Cloud		Config <4.2.7
VMware Tanzu Spring Cloud Config <3.1.14 VMware Tanzu / Spring Cloud		Config <3.1.14

CVE-2026-40981

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
VMware Tanzu Spring Cloud Config OSS <4.3.3 VMware Tanzu / Spring Cloud		Config OSS <4.3.3
VMware Tanzu Spring Cloud Config OSS <5.0.3 VMware Tanzu / Spring Cloud		Config OSS <5.0.3
VMware Tanzu Spring Cloud Config <4.1.10 VMware Tanzu / Spring Cloud		Config <4.1.10
VMware Tanzu Spring Cloud Config <4.2.7 VMware Tanzu / Spring Cloud		Config <4.2.7
VMware Tanzu Spring Cloud Config <3.1.14 VMware Tanzu / Spring Cloud		Config <3.1.14

CVE-2026-40982

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
VMware Tanzu Spring Cloud Config OSS <4.3.3 VMware Tanzu / Spring Cloud		Config OSS <4.3.3
VMware Tanzu Spring Cloud Config OSS <5.0.3 VMware Tanzu / Spring Cloud		Config OSS <5.0.3
VMware Tanzu Spring Cloud Config <4.1.10 VMware Tanzu / Spring Cloud		Config <4.1.10
VMware Tanzu Spring Cloud Config <4.2.7 VMware Tanzu / Spring Cloud		Config <4.2.7
VMware Tanzu Spring Cloud Config <3.1.14 VMware Tanzu / Spring Cloud		Config <3.1.14

References

6 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://spring.io/security/cve-2026-41004	external
https://spring.io/security/cve-2026-41002	external
https://spring.io/security/cve-2026-40982	external
https://spring.io/security/cve-2026-40981	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "VMware Tanzu Spring Cloud ist eine Plattform zur Bereitstellung und Verwaltung von Spring-Anwendungen in Cloud-Umgebungen unter Verwendung von Microservices-Architekturen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Cloud Config ausnutzen, um vertrauliche Informationen offenzulegen oder Daten zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1399 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1399.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1399 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1399"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-05-06",
        "url": "https://spring.io/security/cve-2026-41004"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-05-06",
        "url": "https://spring.io/security/cve-2026-41002"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-05-06",
        "url": "https://spring.io/security/cve-2026-40982"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-05-06",
        "url": "https://spring.io/security/cve-2026-40981"
      }
    ],
    "source_lang": "en-US",
    "title": "VMware Tanzu Spring Cloud Config: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-05-06T22:00:00.000+00:00",
      "generator": {
        "date": "2026-05-07T11:05:54.874+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-1399",
      "initial_release_date": "2026-05-06T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-06T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Config \u003c3.1.14",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Config \u003c3.1.14",
                  "product_id": "T053645"
                }
              },
              {
                "category": "product_version",
                "name": "Config 3.1.14",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Config 3.1.14",
                  "product_id": "T053645-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_cloud:config__3.1.14"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Config \u003c4.1.10",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Config \u003c4.1.10",
                  "product_id": "T053646"
                }
              },
              {
                "category": "product_version",
                "name": "Config 4.1.10",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Config 4.1.10",
                  "product_id": "T053646-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_cloud:config__4.1.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Config \u003c4.2.7",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Config \u003c4.2.7",
                  "product_id": "T053647"
                }
              },
              {
                "category": "product_version",
                "name": "Config 4.2.7",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Config 4.2.7",
                  "product_id": "T053647-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_cloud:config__4.2.7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Config OSS \u003c4.3.3",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Config OSS \u003c4.3.3",
                  "product_id": "T053648"
                }
              },
              {
                "category": "product_version",
                "name": "Config OSS 4.3.3",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Config OSS 4.3.3",
                  "product_id": "T053648-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_cloud:config_oss__4.3.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Config OSS \u003c5.0.3",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Config OSS \u003c5.0.3",
                  "product_id": "T053649"
                }
              },
              {
                "category": "product_version",
                "name": "Config OSS 5.0.3",
                "product": {
                  "name": "VMware Tanzu Spring Cloud Config OSS 5.0.3",
                  "product_id": "T053649-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_cloud:config_oss__5.0.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spring Cloud"
          }
        ],
        "category": "vendor",
        "name": "VMware Tanzu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-41002",
      "product_status": {
        "known_affected": [
          "T053648",
          "T053649",
          "T053646",
          "T053647",
          "T053645"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-41002"
    },
    {
      "cve": "CVE-2026-41004",
      "product_status": {
        "known_affected": [
          "T053648",
          "T053649",
          "T053646",
          "T053647",
          "T053645"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-41004"
    },
    {
      "cve": "CVE-2026-40981",
      "product_status": {
        "known_affected": [
          "T053648",
          "T053649",
          "T053646",
          "T053647",
          "T053645"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-40981"
    },
    {
      "cve": "CVE-2026-40982",
      "product_status": {
        "known_affected": [
          "T053648",
          "T053649",
          "T053646",
          "T053647",
          "T053645"
        ]
      },
      "release_date": "2026-05-06T22:00:00.000+00:00",
      "title": "CVE-2026-40982"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-40981 (GCVE-0-2026-40981)

CERTFR-2026-AVI-0543

Solutions

FKIE_CVE-2026-40981

GHSA-2MH5-3CW6-HRRQ

WID-SEC-W-2026-1399

Tags

Sightings

Nomenclature