---
schema: 1
kind: vulnerability
title: "CVE-2026-40982 — Spring Cloud Config Server: pre-authentication path traversal, CVSS 9.8; all actively-maintained branches affected"
headline: "CVE-2026-40982 — Spring Cloud Config Server: pre-authentication path traversal, CVSS 9.8; all actively-maintained branches affected"
summary: "CVE-2026-40982 (CWE-22, CVSS 9.8) is a pre-authentication directory traversal in Spring Cloud Config Server — the configuration management backbone of Spring Cloud microservices architectures."
discovered_at: "2026-05-09T05:00:06Z"
event_date: 2026-05-08
run_id: 2026-05-09-migrated
priority: notable
immediate_action: null
tags:
  - vulnerabilities
  - pre-auth
  - rce
  - patch-available
regions:
  - europe
  - global
sectors: []
entities: []
cves:
  - id: CVE-2026-40982
    cvss: "9.8"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status:
      - patch-available
sources:
  - url: "https://spring.io/security/cve-2026-40982"
    publisher: "Spring.io security advisory — CVE-2026-40982, 2026-05-06"
    role: primary
  - url: "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0543/"
    publisher: "CERT-FR CERTFR-2026-AVI-0543, 2026-05-07"
    role: corroborating
closed_sources: []
evidence: []
verification: multi-source
sourcing_note: null
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions:
  - Identify all Spring Cloud Config Server deployments. The Config Server is frequently deployed as an internal microservice but may be exposed if API gateway routing is misconfigured.
  - "Patch to 4.3.3 (for 4.3.x branch) or 5.0.3 (for 5.0.x branch) per [Spring.io advisory](https://spring.io/security/cve-2026-40982)."
  - Verify that Config Server is not exposed to the internet directly (should only be accessible from services within the same trust zone).
  - "Review config repo files for credentials, TLS private keys, and database connection strings; treat them as potentially exposed if the server was internet-accessible."
migrated_from: briefs/2026-05-09.md
---

CVE-2026-40982 (CWE-22, CVSS 9.8) is a pre-authentication directory traversal in Spring Cloud Config Server — the configuration management backbone of Spring Cloud microservices architectures. The server fails to validate URL path segments before appending them to configured search-location paths; an unauthenticated attacker can craft requests that traverse outside the configuration root to read or write arbitrary files accessible to the server process. Attack complexity is low, no privileges or user interaction required. All actively-maintained branches are affected: 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x, plus all unsupported versions. Open-source patches: 4.3.3 and 5.0.3; backported enterprise patches available via HeroDevs NES for older branches. No in-the-wild exploitation confirmed at time of reporting. Three companion CVEs were disclosed in the same batch: CVE-2026-40981 (HIGH, Google Secrets Manager backend flaw), CVE-2026-41002 (HIGH), CVE-2026-41004 (MEDIUM) ([Spring.io security advisory, 2026-05-06](https://spring.io/security/cve-2026-40982) · [CERT-FR CERTFR-2026-AVI-0543, 2026-05-07](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0543/) · [HeroDevs analysis, 2026-05-08](https://www.herodevs.com/blog-posts/cve-2026-40982-critical-spring-cloud-config-server-directory-traversal-cvss-9-8)).

Spring Cloud Config is pervasive in Java-based enterprise and government digital-transformation projects across the EU; a compromise of the config server can expose credentials, TLS certificates, database connection strings, and API keys for every connected microservice.