CVE-2026-47837: Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-26 · updated 2026-09-04
Weakness: CWE-306

Description

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.

Affected products

Spring Cloud Config: before 3.1.15; from 4.0.0 before 4.2.9; from 4.3.0 before 4.3.5; from 5.0.0 before 5.0.5 — fixed in 3.1.15, 4.2.9, 4.3.5, 5.0.5
Spring Cloud Config: from 5.0.0 through 5.0.4; from 4.3.0 through 4.3.4; from 4.0.0 through 4.2.8; through 3.1.14

How to fix

Upgrade to a fixed version: Spring Cloud Config 3.1.15, 4.2.9, 4.3.5, 5.0.5. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-47837

Get alerted when CVE-2026-47837 or the next vulnerability affects your stack