CVE-2026-40981
Full vulnerability record from the local CVENow database.
Description
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-05-07 04:16:24.607000
Last modified
2026-10-26 19:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-40981",
"sourceIdentifier": "[email protected]",
"published": "2026-05-07T04:16:24.607",
"lastModified": "2026-10-26T19:10:00.163",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.\nSpring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater."
},
{
"lang": "es",
"value": "Al usar Google Secrets Manager como backend para el servidor de Spring Cloud Config, un cliente puede elaborar una solicitud al servidor de configuración, exponiendo potencialmente secretos de proyectos de GCP no deseados.\nSpring Cloud Config 3.1.x: afectado desde 3.1.0 hasta 3.1.13 (inclusive); actualizar a 3.1.14 o superior (Solo Soporte Empresarial). Spring Cloud Config 4.1.x: afectado desde 4.1.0 hasta 4.1.9 (inclusive); actualizar a 4.1.10 o superior (Solo Soporte Empresarial). Spring Cloud Config 4.2.x: afectado desde 4.2.0 hasta 4.2.6 (inclusive); actualizar a 4.2.7 o superior (Solo Soporte Empresarial). Spring Cloud Config 4.3.x: afectado desde 4.3.0 hasta 4.3.2 (inclusive); actualizar a 4.3.3 o superior. Spring Cloud Config 5.0.x: afectado desde 5.0.0 hasta 5.0.2 (inclusive); actualizar a 5.0.3 o superior."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Spring",
"product": "Spring Cloud Config",
"defaultStatus": "unaffected",
"versions": [
{
"version": "3.1.0",
"lessThan": "3.1.14",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.1.0",
"lessThan": "4.1.10",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.2.0",
"lessThan": "4.2.7",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.3.0",
"lessThan": "4.3.3",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.0.0",
"lessThan": "5.0.3",
"versionType": "custom",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "log4j:2/log4j",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "spring-cloud-config-server",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-07T12:57:24.983565Z",
"id": "CVE-2026-40981",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-639"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-1220"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.1.0",
"versionEndExcluding": "3.1.14",
"matchCriteriaId": "A35B9ECF-3B4A-4E35-8CDE-54EC21E723DB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.0",
"versionEndExcluding": "4.1.10",
"matchCriteriaId": "446B9053-153B-41E3-A339-C216572E5450"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.2.0",
"versionEndExcluding": "4.2.7",
"matchCriteriaId": "2B36B389-41C0-400D-BA92-F5905C9BEBFD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.3.0",
"versionEndExcluding": "4.3.3",
"matchCriteriaId": "5E965315-4507-461D-979F-D5F5602EC8D3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.0.0",
"versionEndExcluding": "5.0.3",
"matchCriteriaId": "218A144D-2CDA-4873-899C-7D8718D5601F"
}
]
}
]
}
],
"references": [
{
"url": "https://spring.io/security/cve-2026-40981",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-40981",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467621",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40981.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}