Missing Authentication Vulnerability in Spring Cloud Config by Spring
CVE-2026-47837

6.8MEDIUM

Key Information:

Vendor

Spring

Status
Spring Cloud Config
Vendor
CVE Published:
26 August 2026

What is CVE-2026-47837?

A missing authentication vulnerability exists in Spring Cloud Config, affecting multiple versions, which allows unauthorized access to the /monitor endpoint. This issue can lead to unvalidated webhook requests being processed by the server, thereby potentially exposing sensitive operations to malicious actors. It is critical for users to secure their configurations to prevent exploitation.

Affected Version(s)

Spring Cloud Config 5.0.0 <= 5.0.4

Spring Cloud Config 4.3.0 <= 4.3.4

Spring Cloud Config 4.0.0 <= 4.2.8

References

https://spring.io/security/cve-2026-47837

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.