CVE-2026-41004
Undergoing Analysis Undergoing Analysis - In Progress
Information Disclosure in Spring Cloud Config Server

Publication date: 2026-05-07

Last updated on: 2026-05-07

Assigner: VMware

Description
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-07
Last Modified
2026-05-07
Generated
2026-06-16
AI Q&A
2026-05-07
EPSS Evaluated
2026-06-15
NVD
CVE-2026-41004
EUVD
EUVD-2026-28250
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
vmware spring_cloud_config From 3.1.0 (inc) to 3.1.13 (inc)
vmware spring_cloud_config From 4.1.0 (inc) to 4.1.9 (inc)
vmware spring_cloud_config From 4.2.0 (inc) to 4.2.6 (inc)
vmware spring_cloud_config From 4.3.0 (inc) to 4.3.2 (inc)
vmware spring_cloud_config From 5.0.0 (inc) to 5.0.2 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-41004 is a security vulnerability in Spring Cloud Config Server where enabling trace logging causes sensitive information to be recorded in plain text within the logs.

This exposure affects multiple versions of Spring Cloud Config, including 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x.

The issue arises specifically when trace logging is enabled, which inadvertently logs sensitive data without encryption or masking.

Impact Analysis

This vulnerability can lead to sensitive information being exposed in logs in plain text, which could be accessed by unauthorized users with log access.

Such exposure increases the risk of data leakage, potentially compromising confidential data and leading to security breaches.

Because the vulnerability has a medium severity rating, it represents a significant risk especially in environments where logs are not properly secured.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Spring Cloud Config Server to a fixed version that addresses the issue.

  • Upgrade to version 3.1.14 or greater if you are using the 3.1.x series (Enterprise Support Only).
  • Upgrade to version 4.1.10 or greater if you are using the 4.1.x series (Enterprise Support Only).
  • Upgrade to version 4.2.7 or greater if you are using the 4.2.x series (Enterprise Support Only).
  • Upgrade to version 4.3.3 or greater if you are using the 4.3.x series (OSS).
  • Upgrade to version 5.0.3 or greater if you are using the 5.0.x series (OSS).
Compliance Impact

This vulnerability involves sensitive information being exposed in plain text within logs when trace logging is enabled in Spring Cloud Config Server.

Exposure of sensitive information in logs can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require the protection of personal and sensitive data from unauthorized access or disclosure.

Therefore, if exploited, this vulnerability could result in violations of these standards due to improper handling and exposure of sensitive data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41004. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart