CVE-2026-47894: Spring Cloud Config Server Native Environment Repository Exposure

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-27 · updated 2026-09-01

Description

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

Affected products

Spring Cloud Config: before 3.1.15; from 4.0.0 before 4.2.9; from 4.3.0 before 4.3.5; from 5.0.0 before 5.0.5 — fixed in 3.1.15, 4.2.9, 4.3.5, 5.0.5
Spring Cloud Config: from 5.0.0 through 5.0.4; from 4.3.0 through 4.3.4; from 4.0.0 through 4.2.8; through 3.1.14

How to fix

Upgrade to a fixed version: Spring Cloud Config 3.1.15, 4.2.9, 4.3.5, 5.0.5. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-47894

Get alerted when CVE-2026-47894 or the next vulnerability affects your stack