CVE-2026-47837mediumCWE-306

Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 0.3%

probabilidade de exploração

0.3%top 77% das CVEs

exploração observada

nãonenhuma fonte reporta

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Produtos afetados

Spring · Spring Cloud Config

Referências

https://spring.io/security/cve-2026-47837