CVE-2026-41004
BaseFortify
Publication date: 2026-05-07
Last updated on: 2026-05-07
Assigner: VMware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vmware | spring_cloud_config | From 3.1.0 (inc) to 3.1.13 (inc) |
| vmware | spring_cloud_config | From 4.1.0 (inc) to 4.1.9 (inc) |
| vmware | spring_cloud_config | From 4.2.0 (inc) to 4.2.6 (inc) |
| vmware | spring_cloud_config | From 4.3.0 (inc) to 4.3.2 (inc) |
| vmware | spring_cloud_config | From 5.0.0 (inc) to 5.0.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-41004 is a security vulnerability in Spring Cloud Config Server where enabling trace logging causes sensitive information to be recorded in plain text within the logs.
This exposure affects multiple versions of Spring Cloud Config, including 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x.
The issue arises specifically when trace logging is enabled, which inadvertently logs sensitive data without encryption or masking.
How can this vulnerability impact me? :
This vulnerability can lead to sensitive information being exposed in logs in plain text, which could be accessed by unauthorized users with log access.
Such exposure increases the risk of data leakage, potentially compromising confidential data and leading to security breaches.
Because the vulnerability has a medium severity rating, it represents a significant risk especially in environments where logs are not properly secured.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your Spring Cloud Config Server to a fixed version that addresses the issue.
- Upgrade to version 3.1.14 or greater if you are using the 3.1.x series (Enterprise Support Only).
- Upgrade to version 4.1.10 or greater if you are using the 4.1.x series (Enterprise Support Only).
- Upgrade to version 4.2.7 or greater if you are using the 4.2.x series (Enterprise Support Only).
- Upgrade to version 4.3.3 or greater if you are using the 4.3.x series (OSS).
- Upgrade to version 5.0.3 or greater if you are using the 5.0.x series (OSS).
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves sensitive information being exposed in plain text within logs when trace logging is enabled in Spring Cloud Config Server.
Exposure of sensitive information in logs can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require the protection of personal and sensitive data from unauthorized access or disclosure.
Therefore, if exploited, this vulnerability could result in violations of these standards due to improper handling and exposure of sensitive data.