CVE-2026-40982 Spring CVE debrief

Who should care

Security teams and administrators responsible for VMware Spring Cloud Config deployments should be aware of this vulnerability. Affected versions are widely used, and exploitation can lead to unauthorized access and data breaches. Immediate attention is required to assess and mitigate this vulnerability.

Technical summary

CVE-2026-40982 is a directory traversal vulnerability in VMware Spring Cloud Config's spring-cloud-config-server module. A malicious user or attacker can send a specially crafted URL to exploit this vulnerability, potentially leading to unauthorized access and data breaches. The vulnerability affects multiple versions of Spring Cloud Config, including 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Defensive priority

High priority should be given to patching affected versions of Spring Cloud Config. Security teams should immediately assess their deployments and apply the recommended upgrades to prevent exploitation.

Recommended defensive actions

• Assess Spring Cloud Config deployments for affected versions.
• Upgrade to 3.1.14, 4.1.10, 4.2.7, 4.3.3, or 5.0.3 for affected versions.
• Monitor for suspicious URL requests to detect potential exploitation attempts.
• Implement additional security measures, such as URL validation and filtering.
• Review and update incident response plans to address potential breaches.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability and affected versions. Vendor advisories and source references offer additional context and mitigation guidance. The CVSS score and vector provide a measure of the vulnerability's severity.

Official resources