CVE-2026-47894 — Spring Cloud Config Server Native Environment Repository Exposure

CVE-2026-47894

Spring Cloud Config Server Native Environment Repository Exposure PUBLISHED

Description (CNA)

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

Affected (CNA)

Vendor / product	Versions
Spring / Spring Cloud Config	affected 5.0.0 through 5.0.4; affected 4.3.0 through 4.3.4; affected 4.0.0 through 4.2.8; affected 0 through 3.1.14

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-47894

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.