CVE-2025-22232: Spring Cloud Config Auth Bypass Flaw

CVE-2025-22232 Overview

CVE-2025-22232 affects Spring Cloud Config Server deployments that integrate with HashiCorp Vault through Spring Vault. The Config Server fails to use the Vault token supplied by clients through the X-CONFIG-TOKEN header when the default LifecycleAwareSessionManager or SimpleSessionManager implementation is active. The SessionManager caches the first token it receives and continues reusing that token for subsequent Vault requests, ignoring tokens sent by later clients. This authentication flaw [CWE-287] can cause requests to be authorized under an unintended identity, leading to information disclosure across tenants sharing the same Config Server.

Critical Impact
Spring Cloud Config Server may authenticate Vault requests using a cached token from a prior client, ignoring the X-CONFIG-TOKEN sent by the current caller.

Affected Products

Spring Cloud Config 2.2.1.RELEASE through 4.2.1
Spring Cloud Config 3.0.x and 2.2.x (out of support)
Deployments with Spring Vault on the classpath using X-CONFIG-TOKEN header-based Vault authentication

Discovery Timeline

2025-04-10 - CVE-2025-22232 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22232

Vulnerability Analysis

Spring Cloud Config Server can act as a broker between client applications and HashiCorp Vault for secrets retrieval. Clients pass their Vault token in the X-CONFIG-TOKEN HTTP header so the Config Server can request secrets on their behalf. The Config Server delegates Vault interactions to a SessionManager implementation from Spring Vault. Both LifecycleAwareSessionManager (the default) and SimpleSessionManager persist the first token obtained and reuse it for the lifetime of the manager. As a result, subsequent requests that carry a different X-CONFIG-TOKEN value are still authenticated to Vault using the originally cached token. The condition maps to improper authentication [CWE-287].

Root Cause

The root cause is a mismatch between per-request token semantics expected by clients and per-instance token caching implemented by the session manager. Spring Cloud Config Server does not construct a request-scoped SessionManager or invalidate the cached token when a new X-CONFIG-TOKEN value arrives. The manager treats the first token as authoritative for its entire lifecycle.

Attack Vector

An attacker with valid access to the Config Server can retrieve secrets scoped to another tenant if that tenant's token was cached first. The attack requires no authentication at the Config Server layer beyond sending a Vault token, and it is exploitable over the network. Exploitation is passive: the attacker submits a normal secrets request and receives data authorized by the previously cached token rather than their own.

No public exploit code is available for CVE-2025-22232. Refer to the Spring Security Advisory CVE-2025-22232 for authoritative technical detail.

Detection Methods for CVE-2025-22232

Indicators of Compromise

Vault audit log entries showing secret reads authenticated by a token that does not match the client identity that initiated the Config Server request.
Config Server access logs containing X-CONFIG-TOKEN values that differ from the token seen in downstream Vault authentication events.
Cross-tenant secret retrievals appearing in Vault audit logs from a single Config Server instance.

Detection Strategies

Correlate Config Server request logs with Vault audit logs by timestamp and source to identify token substitution.
Inventory Spring Cloud Config Server deployments and confirm whether Spring Vault is on the classpath and X-CONFIG-TOKEN is in use.
Review the configured SessionManager implementation and flag LifecycleAwareSessionManager or SimpleSessionManager in production.

Monitoring Recommendations

Enable Vault audit devices and forward events to a centralized log platform for correlation with Config Server telemetry.
Alert on anomalous secret paths accessed by a single Vault token across unrelated client identities.
Track version metadata for Spring Cloud Config deployments to identify unpatched instances.

How to Mitigate CVE-2025-22232

Immediate Actions Required

Upgrade Spring Cloud Config Server to a fixed release matching your branch.
Rotate any Vault tokens that may have been cached and reused by an affected Config Server.
Review Vault audit logs for signs of unintended cross-client secret access.

Patch Information

Spring has released fixes across supported branches. Upgrade 4.2.x to 4.2.2 (OSS), 4.1.x to 4.1.6 (OSS), 4.0.x to 4.0.10 (commercial), and 3.1.x to 3.1.10 (commercial). Users of 3.0.x and 2.2.x should migrate to 4.1.6 (OSS) since those branches are end of life. See the Spring Security Advisory CVE-2025-22232 for the complete fix matrix.

Workarounds

No workarounds are documented by the vendor. Upgrading is required.
If upgrade is delayed, restrict Config Server access to a single tenant per instance to prevent token reuse across clients.
Disable header-based Vault token forwarding and use per-instance service tokens where feasible.

bash

# Example Maven dependency upgrade for the 4.1.x branch
# pom.xml
<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-config-server</artifactId>
    <version>4.1.6</version>
</dependency>