Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.springframework.cloud/spring-cloud-config@4.1.0
purl pkg:maven/org.springframework.cloud/spring-cloud-config@4.1.0
Next non-vulnerable version 4.3.3
Latest non-vulnerable version 5.0.3
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-1vzp-x3f4-aqay
Aliases:
CVE-2026-40981
GHSA-2mh5-3cw6-hrrq
When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
4.3.3
Affected by 0 other vulnerabilities.
5.0.3
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-13T06:30:03.595284+00:00 GHSA Importer Affected by VCID-1vzp-x3f4-aqay https://github.com/advisories/GHSA-2mh5-3cw6-hrrq 38.6.0
2026-06-12T22:23:36.636190+00:00 GitLab Importer Affected by VCID-1vzp-x3f4-aqay https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework.cloud/spring-cloud-config/CVE-2026-40981.yml 38.6.0