CVE-2026-40981: Spring Cloud Config Info Disclosure Flaw

CVE-2026-40981 Overview

CVE-2026-40981 is an authorization flaw in Spring Cloud Config when configured with Google Secrets Manager as a backend. A remote, unauthenticated client can craft a request to the config server that resolves secrets from unintended Google Cloud Platform (GCP) projects. The issue is classified under [CWE-639] (Authorization Bypass Through User-Controlled Key) and carries a CVSS 3.1 base score of 7.5. Affected branches span Spring Cloud Config 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x. The vulnerability impacts confidentiality only, but the exposed material can include API keys, database credentials, and other secrets stored across an organization's GCP projects.

Critical Impact

A network-reachable attacker without credentials can retrieve secrets from GCP projects that the config server should not expose, leading to credential leakage across project boundaries.

Affected Products

• Spring Cloud Config 3.1.0 through 3.1.13 (fix in 3.1.14, Enterprise Support Only)
• Spring Cloud Config 4.1.0 through 4.1.9 (fix in 4.1.10, Enterprise Support Only) and 4.2.0 through 4.2.6 (fix in 4.2.7, Enterprise Support Only)
• Spring Cloud Config 4.3.0 through 4.3.2 (fix in 4.3.3) and 5.0.0 through 5.0.2 (fix in 5.0.3)

Discovery Timeline

• 2026-05-07 - CVE-2026-40981 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-40981

Vulnerability Analysis

Spring Cloud Config centralizes externalized configuration for distributed applications and supports pluggable backends, including Google Secrets Manager. When a client requests a configuration resource, the server resolves secret references against the configured backend. The flaw allows a client to influence the GCP project scope used during secret lookup. By manipulating request parameters, an attacker can redirect resolution to projects the deployment was never intended to serve.

The condition is exploitable over the network, requires no authentication, and demands no user interaction. Successful requests return high-confidentiality data such as API tokens, signing keys, service account credentials, and database passwords. Integrity and availability are not directly affected, but disclosed secrets typically enable follow-on attacks against downstream cloud workloads.

Root Cause

The root cause is insufficient validation of the project identifier used when querying Google Secrets Manager. The server treats a client-controllable value as trusted input to the secret-resolution path. This is a classic authorization-by-key failure cataloged as [CWE-639], where the key selecting the resource is attacker-controlled rather than bound to a server-side authorization decision.

Attack Vector

An attacker sends a crafted HTTP request to an exposed Spring Cloud Config server endpoint. The request includes parameters that manipulate the GCP project scope referenced during secret lookup. The config server forwards the lookup to Google Secrets Manager using the credentials of its own service account. If that service account has access to additional projects, secrets from those projects are returned in the response. See the Spring Security advisory for CVE-2026-40981 for vendor-supplied technical details.

Detection Methods for CVE-2026-40981

Indicators of Compromise

• HTTP requests to /{application}/{profile} or /{application}/{profile}/{label} endpoints containing unexpected project identifiers, path segments, or property keys referencing GCP projects outside the intended scope.
• Outbound calls from the config server's service account to Google Secrets Manager APIs (secretmanager.googleapis.com) targeting project IDs not associated with the application's environment.
• Unusual spikes in AccessSecretVersion API calls in GCP audit logs originating from the config server identity.

Detection Strategies

• Inspect Spring Cloud Config access logs for anomalous request paths and query parameters that reference foreign project names or unusual secret identifiers.
• Correlate config server request logs with GCP Cloud Audit Logs to flag any secret access where the requested project differs from the deployment's intended project.
• Alert on responses from the config server that contain secret payloads served to unauthenticated or low-privilege clients.

Monitoring Recommendations

• Enable verbose request logging on the Spring Cloud Config server and forward logs to a centralized analytics platform for review.
• Turn on Data Access audit logs in GCP for Secret Manager and monitor AccessSecretVersion events by caller identity and target project.
• Track service account permission boundaries continuously and alert when the config server identity gains access to new projects.

How to Mitigate CVE-2026-40981

Immediate Actions Required

• Upgrade Spring Cloud Config to a fixed release: 3.1.14, 4.1.10, 4.2.7 (Enterprise Support Only branches), 4.3.3, or 5.0.3 or later.
• Restrict the config server's GCP service account to only the specific projects and secrets required, applying least privilege at the IAM layer.
• Place the config server behind authentication and network controls so that only trusted clients can issue requests.

Patch Information

VMware addressed the issue in Spring Cloud Config versions 3.1.14, 4.1.10, 4.2.7, 4.3.3, and 5.0.3. Versions 3.1.14, 4.1.10, and 4.2.7 are available through Enterprise Support only. Refer to the Spring Security advisory for CVE-2026-40981 for vendor guidance and download details.

Workarounds

• Scope the config server's GCP service account credentials to a single project so cross-project resolution becomes impossible at the IAM layer.
• Require client authentication on the config server and reject requests containing unexpected path segments or property identifiers via a reverse proxy or web application firewall.
• Disable the Google Secrets Manager backend until patched, substituting a backend that does not expose project selection to client-controlled input.

# Configuration example: pin GCP credentials to a single project
# and enforce HTTP basic authentication on the config server
spring:
  cloud:
    config:
      server:
        googlesecretsmanager:
          project-id: my-locked-project
  security:
    user:
      name: configclient
      password: ${CONFIG_CLIENT_PASSWORD}