Description

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-26T18:16:33.177Z",
  "pubdate": "2026-08-26T18:16:33.177Z",
  "executiveSummary": "This vulnerability involves a Missing Authentication for Critical Function flaw within the Spring Cloud Config Server's /monitor endpoint.\nThe issue permits unauthenticated remote actors to trigger refresh operations via crafted webhook requests.\nAffected products include Spring Cloud Config versions 5.0.0 through 5.0.4, 4.3.0 through 4.3.4, 4.0.0 through 4.2.8, and 3.1.14.\nSuccessful exploitation allows an attacker to force the server to pull configuration updates from an external repository without validation of the request source.\nThe primary risk implication is the potential for unauthorized configuration synchronization, which could lead to application instability, service disruption, or the injection of malicious configuration parameters if an attacker can influence the underlying configuration repository.\nAttackers do not require specific privileges or pre-existing credentials, as the endpoint lacks the necessary security constraints to verify the authenticity of incoming webhook notifications.\nThe vulnerability exposes the management infrastructure to remote exploitation, necessitating immediate attention to network-level access controls and software updates.",
  "technicalDetails": "The vulnerability resides in the /monitor endpoint of the Spring Cloud Config Server, which is designed to handle webhooks for configuration refresh events.\nThe root cause is the absence of adequate authentication and authorization mechanisms for this specific HTTP endpoint, allowing requests to be processed without verifying their origin or integrity.\nUnder normal operating conditions, the /monitor endpoint expects a validated notification from a trusted version control system repository; however, due to the missing authentication check, any actor with network reachability to the server can issue HTTP POST requests to this endpoint.\nThe attack flow commences with the adversary identifying the publicly accessible /monitor endpoint on a target Spring Cloud Config Server. Because the application fails to validate the request sender, the attacker does not need to provide a valid signature, security token, or administrative credentials.\nUpon sending an unauthenticated HTTP request to the /monitor endpoint, the server triggers an internal refresh event. This causes the Spring Cloud Config Server to perform a fetch operation against its configured backend repository.\nIf the attacker has previously compromised the backend configuration repository or can point the configuration to a repository under their control—depending on specific implementation configurations—they can force the application to reload its settings.\nThe exploitation method relies on the server's blind trust in the incoming webhook trigger. This behavior can be abused to perform denial-of-service (DoS) attacks by repeatedly forcing the server to reload, consume CPU resources, and exhaust network bandwidth.\nFurthermore, in environments where configuration reloading is coupled with sensitive logic or dynamic property injection, an attacker may leverage this flaw to effectively change application runtime behavior by triggering reloads at malicious intervals or with specific parameters.\nThe vulnerability affects Spring Cloud Config versions 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, and 3.1.14. The lack of network segmentation or firewalling around the Config Server exacerbates the risk, as the endpoint is often reachable from broad network segments if not explicitly protected by an API gateway or reverse proxy implementing mutual TLS or source-IP allowlisting."
}