CVE-2026-47894: Spring Cloud Config Information Disclosure

CVE-2026-47894 Overview

CVE-2026-47894 affects Spring Cloud Config Server when configured with a native environment repository. The flaw permits an authenticated user to retrieve configuration files stored outside of the configured repository path. This is a path traversal weakness that breaks the boundary between the configured repository directory and the surrounding filesystem.

The issue impacts multiple supported release lines of Spring Cloud Config. Successful exploitation exposes sensitive configuration data managed by the Config Server without altering system state or availability.

Critical Impact
Authenticated attackers can read configuration files outside the intended repository root, exposing secrets, credentials, and application settings served by Spring Cloud Config Server.

Affected Products

Spring Cloud Config 5.0.0 through 5.0.4
Spring Cloud Config 4.3.0 through 4.3.4, 4.0.0 through 4.2.8
Spring Cloud Config 3.1.14 and earlier

Discovery Timeline

2026-08-27 - CVE-2026-47894 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47894

Vulnerability Analysis

Spring Cloud Config Server provides externalized configuration to distributed applications. The native profile serves configuration files directly from a local filesystem or classpath location rather than from a Git backend. Requests to the server are mapped to files within that configured repository path.

The vulnerability allows the resolution logic to return files located outside the configured path. An authenticated client with the privileges required to request configuration resources can craft input that traverses beyond the intended directory. The result is disclosure of arbitrary files that the Config Server process can read.

This is an information disclosure issue. Integrity and availability of the server are not affected, but leaked configuration frequently contains database credentials, API keys, and internal service endpoints.

Root Cause

The root cause is insufficient validation of resource paths in the native environment repository implementation [CWE-22 Path Traversal]. Requested resource identifiers are combined with the configured repository root without properly rejecting sequences that escape the base directory. The resolved path is then read and returned to the caller.

Attack Vector

An attacker requires network access to the Config Server endpoints and valid high-privilege credentials to authenticate. No user interaction is required. The attacker issues a configuration retrieval request whose parameters resolve to a location outside the repository root, and the server returns the file contents.

No verified public exploit code is available for CVE-2026-47894. Refer to the Spring Security advisory for CVE-2026-47894 for authoritative technical detail.

Detection Methods for CVE-2026-47894

Indicators of Compromise

Config Server access logs containing path segments such as .., encoded traversal sequences (%2e%2e), or absolute filesystem paths in application or label parameters.
Successful HTTP 200 responses to configuration requests returning unusually large payloads or content not associated with any registered application.
Authenticated requests originating from accounts that do not normally consume configuration from the Config Server.

Detection Strategies

Enable verbose request logging on Spring Cloud Config Server and alert on requests whose resolved file paths fall outside the configured spring.cloud.config.server.native.searchLocations directory.
Correlate Config Server authentication events with configuration retrieval volume to identify credential misuse.
Inspect reverse proxy or API gateway logs for traversal patterns targeting /{application}/{profile} and /{application}/{profile}/{label} endpoints.

Monitoring Recommendations

Forward Config Server application logs and access logs to a centralized analytics platform for retention and correlation.
Baseline normal configuration retrieval patterns per client and alert on deviations in requested resources.
Monitor filesystem read activity by the Config Server process for access to paths outside the configured repository root.

How to Mitigate CVE-2026-47894

Immediate Actions Required

Upgrade Spring Cloud Config to a fixed release line as identified in the Spring Security advisory.
Rotate any credentials, tokens, or secrets stored in files accessible to the Config Server, since exposure cannot be ruled out.
Restrict network access to the Config Server so that only authorized services can reach its endpoints.
Review Config Server authentication and reduce the number of accounts with configuration read privileges.

Patch Information

VMware/Spring has published fixed versions for the affected release lines. Consult the Spring Security advisory for CVE-2026-47894 for the specific patched builds corresponding to the 5.0.x, 4.3.x, 4.2.x, and 3.1.x branches, and update Maven or Gradle dependency coordinates accordingly.

Workarounds

Migrate from the native profile to a Git-backed environment repository where feasible, which does not use the vulnerable filesystem resolution path.
Run the Config Server process under an operating system account whose filesystem permissions are limited strictly to the intended repository directory.
Place the Config Server behind an authenticating gateway that validates request paths and rejects traversal sequences before they reach the application.

bash

# Configuration example: restrict native search locations and OS-level read scope
spring:
  cloud:
    config:
      server:
        native:
          searchLocations: file:/opt/config-repo/

# Ensure the service account can only read the intended directory
chown -R configsvc:configsvc /opt/config-repo
chmod -R 750 /opt/config-repo