要点
- CVE-2026-41004 是影响 org.springframework.cloud:spring-cloud-config-server, spring cloud config (vmware) 的中危 (CVSS 4.4)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.17%，高于 6.0% 的漏洞。
- 修复：升级到 4.3.3, 5.0.3, 3.1.14, 4.1.10 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| org.springframework.cloud:spring-cloud-config-server Maven | ≥ 3.0.0, ≤ 3.0.7≥ 3.1.0, ≤ 3.1.13≥ 4.1.0, ≤ 4.1.9≥ 4.2.0, ≤ 4.2.6≥ 4.3.0, < 4.3.3≥ 5.0.0, < 5.0.3
| 4.3.35.0.3
|
| spring cloud config | ≥ 3.1.0, < 3.1.14≥ 4.1.0, < 4.1.10≥ 4.2.0, < 4.2.7≥ 4.3.0, < 4.3.3≥ 5.0.0, < 5.0.3
| 3.1.144.1.104.2.74.3.35.0.3
|
Description
When trace logging is enabled in Spring Cloud Config Server, sensitive information is placed in plain text in the logs.
- Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 (inclusive); no open-source upgrade available.
- Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); no open-source upgrade available.
- Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater.
- Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
NVD description
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
org.springframework.cloud:spring-cloud-config-server 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free