Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2026-47837

Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring Cloud Config

Default version status: unaffected

  • 5.0.0 to ≤ 5.0.4affected
  • 4.3.0 to ≤ 4.3.4affected
  • 4.0.0 to ≤ 4.2.8affected
  • 0 to ≤ 3.1.14affected

References