CVE-2026-47894

Published: Aug 27, 2026Modified: Sep 1, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

Affected (4)

Products: Vmware: Spring Cloud Config

Vmware

1 product

Spring Cloud Config

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Cloud Config	Before 3.1.15
Vmware Spring Cloud Config	From 4.0.0 to 4.2.9
Vmware Spring Cloud Config	From 4.3.0 to 4.3.5
Vmware Spring Cloud Config	From 5.0.0 to 5.0.5

References (1)

https://spring.io/security/cve-2026-47894

Source: security@vmware.com

Vendor Advisory

Timeline

No history available yet.