CVE-2026-47894

Name of the Vulnerable Software and Affected Versions Spring Cloud Config versions 5.0.0 through 5.0.4 Spring Cloud Config versions 4.3.0 through 4.3.4 Spring Cloud Config versions 4.0.0 through 4.2.8 Spring Cloud Config versions 3.1.14 and earlier

Description The native environment repository in Spring Cloud Config Server allows the exposure of configuration files located outside of the configured repository path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.