CVE-2026-40981

{"id": "CVE-2026-40981", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40981", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T12:57:24.983565Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring Cloud Config", "versions": [{"status": "affected", "version": "3.1.0", "lessThan": "3.1.14", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.10", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.7", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.3", "versionType": "custom"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.3", "versionType": "custom"}], "defaultStatus": "unaffected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "log4j:2/log4j", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "spring-cloud-config-server", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-05-07T04:16:24.607", "references": [{"url": "https://spring.io/security/cve-2026-40981", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-40981", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467621", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40981.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-639"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-1220"}]}], "descriptions": [{"lang": "en", "value": "When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.\nSpring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater."}, {"lang": "es", "value": "Al usar Google Secrets Manager como backend para el servidor de Spring Cloud Config, un cliente puede elaborar una solicitud al servidor de configuraci\u00f3n, exponiendo potencialmente secretos de proyectos de GCP no deseados.\nSpring Cloud Config 3.1.x: afectado desde 3.1.0 hasta 3.1.13 (inclusive); actualizar a 3.1.14 o superior (Solo Soporte Empresarial). Spring Cloud Config 4.1.x: afectado desde 4.1.0 hasta 4.1.9 (inclusive); actualizar a 4.1.10 o superior (Solo Soporte Empresarial). Spring Cloud Config 4.2.x: afectado desde 4.2.0 hasta 4.2.6 (inclusive); actualizar a 4.2.7 o superior (Solo Soporte Empresarial). Spring Cloud Config 4.3.x: afectado desde 4.3.0 hasta 4.3.2 (inclusive); actualizar a 4.3.3 o superior. Spring Cloud Config 5.0.x: afectado desde 5.0.0 hasta 5.0.2 (inclusive); actualizar a 5.0.3 o superior."}], "lastModified": "2026-10-26T19:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A35B9ECF-3B4A-4E35-8CDE-54EC21E723DB", "versionEndExcluding": "3.1.14", "versionStartIncluding": "3.1.0"}, {"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "446B9053-153B-41E3-A339-C216572E5450", "versionEndExcluding": "4.1.10", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B36B389-41C0-400D-BA92-F5905C9BEBFD", "versionEndExcluding": "4.2.7", "versionStartIncluding": "4.2.0"}, {"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E965315-4507-461D-979F-D5F5602EC8D3", "versionEndExcluding": "4.3.3", "versionStartIncluding": "4.3.0"}, {"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "218A144D-2CDA-4873-899C-7D8718D5601F", "versionEndExcluding": "5.0.3", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}