CVE-2026-47894
Received Received - Intake

Information Disclosure in Spring Cloud Config Server

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-47894
EUVD
EUVD-2026-66845

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
spring cloud_config From 3.1.14 (inc) to 5.0.4 (inc)
spring cloud_config 5.0.0
spring cloud_config 4.3.0
spring cloud_config 4.0.0
spring cloud_config 3.1.14
vmware spring_cloud_config From 3.1.14 (inc) to 5.0.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Spring Cloud Config Server's native environment repository allows unauthorized access to configuration files stored outside the intended repository path. Attackers could potentially read sensitive configuration data that should be restricted.

Detection Guidance

Check if your Spring Cloud Config Server is running an affected version by inspecting the server logs or version file. Look for unauthorized access attempts to configuration files outside the repository path. Verify if configuration files are being exposed unintentionally by reviewing file access logs.

Impact Analysis

An attacker could exploit this to access sensitive configuration files containing secrets, credentials, or application settings. This may lead to data breaches, unauthorized system access, or further attacks on the application or infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized exposure of personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance violations and penalties if exploited.

Mitigation Strategies

Upgrade to fixed versions: 5.0.5 (OSS), 4.3.5 (Enterprise), 4.2.9 (Enterprise), or 3.1.15 (Enterprise). No additional mitigation steps are required beyond upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47894. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart