CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Spring Cloud Config Server

product · product:spring-cloud-config-server

Coverage
1
first 2026-05-09 → last 2026-10-11
Latest activity
2026-05-09
Spring Cloud Config Server can be made to serve files outside its configuration root without authentication…
Peak priority
routine
1 routine
Targets
·
no sector or region stated
Sources cited
3
3 hosts

Defender insights

What each entry about Spring Cloud Config Server tells a defender to do, newest first.

2026-05-09ROUTINESpring Cloud Config Server can be made to serve files outside its configuration root without authentication; older branches need enterprise-support builds

Exposure

Story timeline

  1. 2026-05-09CVE-2026-40982: Spring Cloud Config Server unauthenticated directory traversal (CVSS 9.1); open-source fixes only for 4.3.x and 5.0.x
    trending-vulnerabilitiesSpring Cloud Config Server can be made to serve files outside its configuration root without authentication; older branches need enterprise-support builds

Hunting pivots

CVEs
CVE-2026-40982
Releases covered
Spring Cloud Config Server
Tags
patch-availablepre-authvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • DiscoveryFile and Directory Discovery

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-09/cve-2026-40982-spring-cloud-config-server-pre-authentication · ATT&CK page ↗

Discovery TA0007

T1083File and Directory Discovery×1

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-05-09/cve-2026-40982-spring-cloud-config-server-pre-authentication · ATT&CK page ↗

Entries about Spring Cloud Config Server (1)

2026-05-09 · view entry permalink →

ROUTINECVE-2026-40982updatedNATOA2

CVE-2026-40982: Spring Cloud Config Server unauthenticated directory traversal (CVSS 9.1); open-source fixes only for 4.3.x and 5.0.x

Spring published CVE-2026-40982 on 2026-05-06: a request with a specially crafted URL can lead to a directory traversal in the spring-cloud-config-server module, which serves text and binary files to applications (Spring, 2026-05-06). The flaw affects 5.0.0 to 5.0.2, 4.3.0 to 4.3.2, 4.2.0 to 4.2.6, 4.1.0 to 4.1.9 and 3.1.13 and earlier; open-source fixes are 5.0.3 and 4.3.3, while 4.2.7, 4.1.10 and 3.1.14 are available through enterprise support only, and Spring lists no other mitigation (Spring, 2026-05-06). HeroDevs gives the CVSS 3.1 score as 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), unauthenticated and low-complexity (HeroDevs, 2026-05-08). CERT-FR relayed the advisory together with the companion flaws CVE-2026-40981, CVE-2026-41002 and CVE-2026-41004 (CERT-FR, 2026-05-07). No source reports exploitation.

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryevent_dateprioritytagsregionscvesaffected_productstechniquessourcesclassificationactionsbody

CVE-2026-40982 scores CVSS 9.1, not 9.8 (HeroDevs, 2026-05-08), and Spring describes a directory traversal, not code execution (Spring, 2026-05-06). Open-source fixes exist only for the 5.0 and 4.3 branches; the 4.2, 4.1 and 3.1 fixes are available through enterprise support only (Spring, 2026-05-06).

vulnerability09 May 05:00Zmulti-sourceOpen finding →
Sources: Spring · CERT-FR · HeroDevs

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cert.ssi.gouv.fr1 (33%)
  • herodevs.com1 (33%)
  • spring.io1 (33%)
All cited sources (3)