CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Spring Cloud Config Server pre-auth directory traversal (CVSS 9.8)

cve · CVE-2026-40982

Coverage
1
first 2026-05-09 → last 2026-10-21
Latest activity
2026-05-09
Unauthenticated directory traversal in Spring Cloud Config Server; open-source fixes only for the 4.3 and 5.0…
Peak priority
routine
1 routine
Targets
·
no sector or region stated
Sources cited
3
3 hosts

Defender insights

What each entry about CVE-2026-40982 tells a defender to do, newest first.

2026-05-09ROUTINEUnauthenticated directory traversal in Spring Cloud Config Server; open-source fixes only for the 4.3 and 5.0 branches

Exposure

Story timeline

  1. 2026-05-09CVE-2026-40982: Spring Cloud Config Server unauthenticated directory traversal (CVSS 9.1); open-source fixes only for 4.3.x and 5.0.x
    trending-vulnerabilitiesUnauthenticated directory traversal in Spring Cloud Config Server; open-source fixes only for the 4.3 and 5.0 branches

Hunting pivots

Affected products
Spring Cloud Config Server
Tags
patch-availablepre-authvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • DiscoveryFile and Directory Discovery

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-09/cve-2026-40982-spring-cloud-config-server-pre-authentication · ATT&CK page ↗

Discovery TA0007

T1083File and Directory Discovery×1

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-05-09/cve-2026-40982-spring-cloud-config-server-pre-authentication · ATT&CK page ↗

Entries about Spring Cloud Config Server pre-auth directory traversal (CVSS 9.8) (1)

2026-05-09 · view entry permalink →

ROUTINECVE-2026-40982updatedNATOA2

CVE-2026-40982: Spring Cloud Config Server unauthenticated directory traversal (CVSS 9.1); open-source fixes only for 4.3.x and 5.0.x

Spring published CVE-2026-40982 on 2026-05-06: a request with a specially crafted URL can lead to a directory traversal in the spring-cloud-config-server module, which serves text and binary files to applications (Spring, 2026-05-06). The flaw affects 5.0.0 to 5.0.2, 4.3.0 to 4.3.2, 4.2.0 to 4.2.6, 4.1.0 to 4.1.9 and 3.1.13 and earlier; open-source fixes are 5.0.3 and 4.3.3, while 4.2.7, 4.1.10 and 3.1.14 are available through enterprise support only, and Spring lists no other mitigation (Spring, 2026-05-06). HeroDevs gives the CVSS 3.1 score as 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), unauthenticated and low-complexity (HeroDevs, 2026-05-08). HeroDevs first says an attacker can read or write arbitrary files the server process can access, then that the Config Server's resource endpoints are read-only, so the direct impact is information disclosure of secrets, credentials or any other file the server process can read, although the vector scores integrity High (HeroDevs, 2026-05-08). CERT-FR relayed the advisory together with the companion flaws CVE-2026-40981, CVE-2026-41002 and CVE-2026-41004 (CERT-FR, 2026-05-07). No source reports exploitation.

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryevent_dateprioritytagsregionscvesaffected_productstechniquessourcesclassificationactionsbody

CVE-2026-40982 scores CVSS 9.1, not 9.8 (HeroDevs, 2026-05-08), and Spring describes a directory traversal, not code execution (Spring, 2026-05-06). Open-source fixes exist only for the 5.0 and 4.3 branches; the 4.2, 4.1 and 3.1 fixes are available through enterprise support only (Spring, 2026-05-06).

Improvementrun 2026-10-21T1149Z-auditbodyheadline

HeroDevs states that the Config Server's resource endpoints are read-only, so the direct impact of the traversal is information disclosure: secrets, credentials or any other file the server process can read, which in typical deployments includes the secrets the Config Server centralizes for a fleet of microservices (HeroDevs, 2026-05-08). The same post also says an attacker can read or write arbitrary files, and the CVSS vector it gives scores integrity High (HeroDevs, 2026-05-08); Spring's advisory describes only a directory traversal (Spring, 2026-05-06).

vulnerability09 May 05:00Zmulti-sourceOpen finding →
Sources: Spring · CERT-FR · HeroDevs

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cert.ssi.gouv.fr1 (33%)
  • herodevs.com1 (33%)
  • spring.io1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)