7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40981

CVE-2026-40981: Spring Cloud Config has an Authorization Bypass Through User-Controlled Key

When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40981

CVE-2026-40981:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.springframework.cloud:spring-cloud-config-server	maven	>= 3.1.0, <= 3.1.13
org.springframework.cloud:spring-cloud-config-server	maven	>= 4.1.0, <= 4.1.9
org.springframework.cloud:spring-cloud-config-server	maven	>= 4.2.0, <= 4.2.6
org.springframework.cloud:spring-cloud-config-server	maven	>= 4.3.0, <= 4.3.2	4.3.3
org.springframework.cloud:spring-cloud-config-server	maven	>= 5.0.0, <= 5.0.2	5.0.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-40981, is an authorization bypass in Spring Cloud Config's Google Secrets Manager backend. The root cause was that the application trusted the X-Project-ID HTTP header sent by the client to determine which Google Cloud Project to retrieve secrets from. There was no validation to ensure the requested project was one the client was authorized to access.

The analysis of the patch between vulnerable version 5.0.2 and fixed version 5.0.3 revealed that the fix was implemented in commit 4e93ce54d0c0abcbcdfaba3a6833a93afe8f59bc. The key change was the introduction of a new class, GcpProjectResolutionSupport, and a new configuration property, spring.cloud.config.server.gcp-secret-manager.allowed-project-ids.

The vulnerable methods, getSecrets() and checkRemotePermissions() in the GoogleSecretManagerV1AccessStrategy class, previously called a private method getProjectId() that directly read and used the project ID from the X-Project-ID header. An attacker could craft a request with this header pointing to any GCP project, and if the Spring Cloud Config server had credentials with access to that project, it would return the secrets.

The patch refactored the logic to use GcpProjectResolutionSupport. This new component now validates the project ID from the header against the allowed-project-ids list when token-mandatory is false. If the list is empty, no client-supplied project IDs are allowed, effectively mitigating the vulnerability. This ensures that clients can only request secrets from projects explicitly allowed by the server's configuration.

Vulnerable functions

org.springframework.cloud.config.server.environment.secretmanager.GoogleSecretManagerV1AccessStrategy.getSecrets

spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/environment/secretmanager/GoogleSecretManagerV1AccessStrategy.java

This function retrieves secrets from Google Secret Manager. Before the patch, it used a project ID that could be controlled by a client via the `X-Project-ID` header without any validation. This allowed a client to access secrets from any GCP project the config server had access to, leading to an authorization bypass.

org.springframework.cloud.config.server.environment.secretmanager.GoogleSecretManagerV1AccessStrategy.checkRemotePermissions

spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/environment/secretmanager/GoogleSecretManagerV1AccessStrategy.java

This function checks permissions on a GCP project. It was vulnerable for the same reason as `getSecrets()`: it used a client-controlled project ID from the `X-Project-ID` header without validation. This could be used by an attacker to probe for projects or permissions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.