CVE-2026-40981: Spring Cloud Config Clients Can Access Secrets From Any Project The Config Server Has Access To On Google Secrets Manager
| Vendor | Product | Versions |
|---|---|---|
| spring | spring cloud config | maven/org.springframework.cloud:spring-cloud-config: >= 3.1.0, <= 3.1.13, maven/org.springframework.cloud:spring-cloud-config: >= 4.1.0, <= 4.1.9, maven/org.springframework.cloud:spring-cloud-config: >= 4.2.0, <= 4.2.6, maven/org.springframework.cloud:spring-cloud-config: >= 4.3.0, <= 4.3.2, maven/org.springframework.cloud:spring-cloud-config: >= 5.0.0, <= 5.0.2 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| maven | org.springframework.cloud:spring-cloud-config | GHSA | 85% |
| vmware tanzu | spring cloud | cert_advisory | 90% |
Updated description for CVE-2026-40981, changed severity to CRITICAL, and marked exploit as available and actively exploited.
Initial creation
