CVE-2026-47894

HIGH 7.5CVE-2026-47894 · Published 27/08/2026 · updated 01/09/2026

In short

CVE-2026-47894 is a HIGH (CVSS 7.5) vulnerability affecting spring cloud config (vmware).
Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 41.9% of all vulnerabilities.
Fix: update to 4.2.9, 4.3.5, 5.0.5, 3.1.15 or later.

Package	Affected versions	Patched versions
spring cloud config vmware	`≥ 4.0.0, < 4.2.9≥ 4.3.0, < 4.3.5≥ 5.0.0, < 5.0.5< 3.1.15`	`4.2.94.3.55.0.53.1.15`

Description

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

References

spring.io/security/cve-2026-47894 · Vendor Advisory

More vulnerabilities in spring cloud config

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

spring cloud config

vmware

≥ 4.0.0, < 4.2.9≥ 4.3.0, < 4.3.5≥ 5.0.0, < 5.0.5< 3.1.15

4.2.94.3.55.0.53.1.15

More vulnerabilities in spring cloud config

See all →