Em resumo
- CVE-2026-41004 é uma vulnerabilidade MÉDIO (CVSS 4.4) que afeta org.springframework.cloud:spring-cloud-config-server, spring cloud config (vmware).
- Chance de exploração nos próximos 30 dias (EPSS): 0.17%, maior que 6.0% das vulnerabilidades.
- Correção: atualize para 4.3.3, 5.0.3, 3.1.14, 4.1.10 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| org.springframework.cloud:spring-cloud-config-server Maven | ≥ 3.0.0, ≤ 3.0.7≥ 3.1.0, ≤ 3.1.13≥ 4.1.0, ≤ 4.1.9≥ 4.2.0, ≤ 4.2.6≥ 4.3.0, < 4.3.3≥ 5.0.0, < 5.0.3
| 4.3.35.0.3
|
| spring cloud config | ≥ 3.1.0, < 3.1.14≥ 4.1.0, < 4.1.10≥ 4.2.0, < 4.2.7≥ 4.3.0, < 4.3.3≥ 5.0.0, < 5.0.3
| 3.1.144.1.104.2.74.3.35.0.3
|
Description
When trace logging is enabled in Spring Cloud Config Server, sensitive information is placed in plain text in the logs.
- Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 (inclusive); no open-source upgrade available.
- Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater.
- Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
NVD description
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Mais vulnerabilidades de org.springframework.cloud:spring-cloud-config-server
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free