CVE-2026-47894

Published September 3, 2026

CVSS 3.14.9

SeverityMedium

Known exploitedNo

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path.
Spring Cloud Config 5.0.0 – 5.0.4
Spring Cloud Config 4.3.0 – 4.3.4
Spring Cloud Config 4.0.0 – 4.2.8
Spring Cloud Config 3.1.14 and earlier

NVD references:

https://spring.io/security/cve-2026-47894

Primary source: NIST National Vulnerability Database

Stay Ahead of the Threat Landscape