4.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41004

CVE-2026-41004: Spring Cloud Config Server Logged Sensitive Information

When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41004

CVE-2026-41004:

4.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.springframework.cloud:spring-cloud-config-server	maven	>= 3.1.0, <= 3.1.13
org.springframework.cloud:spring-cloud-config-server	maven	>= 4.1.0, <= 4.1.9
org.springframework.cloud:spring-cloud-config-server	maven	>= 4.2.0, <= 4.2.6
org.springframework.cloud:spring-cloud-config-server	maven	>= 4.3.0, <= 4.3.2	4.3.3
org.springframework.cloud:spring-cloud-config-server	maven	>= 5.0.0, <= 5.0.2	5.0.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2026-41004 in Spring Cloud Config Server was caused by the logging of sensitive information in plain text when trace logging was enabled. An analysis of the commits between the vulnerable version 5.0.2 and the patched version 5.0.3 revealed a commit fb54c48b5ad86269ff21812b0b9491794339b24d with the message "Remove unnecessary logging". This commit modifies the AwsCodeCommitCredentialProvider.java file to remove the logging of AWS credentials. Specifically, the get method in this class was logging the awsAccessKey and codeCommitPassword. The patch replaces these log statements with generic messages that do not contain sensitive information. Therefore, the vulnerable function is org.springframework.cloud.config.server.support.AwsCodeCommitCredentialProvider.get.

Vulnerable functions

org.springframework.cloud.config.server.support.AwsCodeCommitCredentialProvider.get

spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/support/AwsCodeCommitCredentialProvider.java

The `get` method in `AwsCodeCommitCredentialProvider` was logging the `awsAccessKey` and `codeCommitPassword` at the TRACE level. This could expose sensitive credentials in the application logs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.