Description

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-27T06:17:20.930Z",
  "pubdate": "2026-08-27T06:17:20.930Z",
  "executiveSummary": "This vulnerability is a path traversal flaw residing in the native environment repository implementation of Spring Cloud Config Server.\nThe vulnerability allows unauthorized remote actors to read arbitrary configuration files located outside the intended repository directory.\nThe impact involves potential information disclosure, including sensitive credentials, database connection strings, or environment-specific secrets stored in configuration files.\nAffected products include Spring Cloud Config versions 5.0.0 - 5.0.4, 4.3.0 - 4.3.4, 4.0.0 - 4.2.8, and 3.1.14 and earlier.\nThe vulnerability requires an attacker to possess the capability to send crafted HTTP requests to the Config Server, effectively bypassing directory restrictions designed to confine file access.\nThe risk implication is critical, as successfully exploiting this flaw facilitates the exfiltration of sensitive infrastructure data, which may be leveraged for further lateral movement or unauthorized system access.\nNo specific user interaction is required for exploitation; it relies on the improper sanitization of input parameters within the Config Server's file-fetching mechanism.",
  "technicalDetails": "The vulnerability stems from improper validation and sanitization of user-supplied input when the Config Server processes requests for configuration files in native environment mode.\nThe native environment repository component fails to sufficiently restrict the file system traversal when processing the path parameters, specifically through the use of path traversal sequences (e.g., '../').\nWhen a client requests a configuration file, the application constructs a file path by joining a base directory with the provided application name, profile, and label parameters.\nDue to the failure to sanitize these input parameters, an attacker can manipulate the path by injecting traversal sequences to navigate outside the intended base directory.\nThe attack flow initiates with the attacker identifying the target endpoint of the Config Server. By supplying specifically crafted parameters containing directory traversal characters (such as '%2f..%2f'), the attacker coerces the server-side process into accessing files or directories that reside in unintended locations on the host file system.\nThe vulnerable component is the native environment repository implementation, which does not employ robust canonicalization or validation of the requested file paths before invoking file system access functions.\nThe vulnerability is accessible over the network, assuming the Config Server is reachable, and it does not explicitly require authentication, depending on the specific configuration of the instance.\nThe privilege requirement is minimal as the application typically runs with the privileges of the service account configured to run the Config Server process; hence, the attacker gains the ability to read any file readable by that service account.\nUpon successful exploitation, the payload behavior manifests as the server returning the content of the requested, unauthorized file in the HTTP response body.\nPost-exploitation impact includes full or partial compromise of the application's configuration security posture. Attackers can harvest sensitive data such as API keys, cryptographic secrets, or backend service credentials, which are commonly stored in configuration files, thereby enabling subsequent attacks on connected infrastructure components."
}