← Back

CVE-2026-47837

nvd nist
Published: Aug 26, 2026Modified: Sep 4, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.

Affected (4)

Vmware
1 product
Spring Cloud Config
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Cloud Config
Before 3.1.15
Spring Cloud Config
From 4.0.0 to 4.2.9
Spring Cloud Config
From 4.3.0 to 4.3.5
Spring Cloud Config
From 5.0.0 to 5.0.5

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.