CVE-2026-22739: Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks

Q: What is the severity of CVE-2026-22739?

CVE-2026-22739 is classified as a high severity vulnerability due to potential unintended access to sensitive files and the ability to conduct SSRF attacks.

Q: How do I fix CVE-2026-22739?

To mitigate CVE-2026-22739, upgrade to versions of VMware Spring Cloud that are not affected, specifically above 3.1.13, 4.1.9, 4.2.3, 4.3.2, and 5.0.2.

Q: What kind of attacks can CVE-2026-22739 enable?

CVE-2026-22739 can enable Server-Side Request Forgery (SSRF) attacks and unintended access to filesystem resources.

Q: Which versions of VMware Spring Cloud are affected by CVE-2026-22739?

Affected versions include VMware Spring Cloud versions from 3.1.0 to 3.1.13, 4.1.0 to 4.1.9, 4.2.0 to 4.2.3, 4.3.0 to 4.3.2, and 5.0.0 to 5.0.2.

Q: What is the cause of CVE-2026-22739?

CVE-2026-22739 arises from improper profile parameter substitution in Spring Cloud Config Server when configured with a native file system backend.

Published Mar 24, 2026

Updated

Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.

Affected Software

6 affected components

VMware Spring Cloud>=3.1.0<3.1.13, >=4.1.0<4.1.9, >=4.2.0<4.2.3, >=4.3.0<4.3.2, >=5.0.0<5.0.2

VMware Spring Cloud Config<3.1.13

VMware Spring Cloud Config>=4.1.0<4.1.9

VMware Spring Cloud Config>=4.2.0<4.2.6

VMware Spring Cloud Config>=4.3.0<4.3.2

VMware Spring Cloud Config>=5.0.0<5.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Spring Cloud Config to a version that resolves this vulnerability.
Fixed in 3.1.13
Upgrade
Upgrade Spring Cloud Config to a version that resolves this vulnerability.
Fixed in 4.1.9
Upgrade
Upgrade Spring Cloud Config to a version that resolves this vulnerability.
Fixed in 4.2.3
Upgrade
Upgrade Spring Cloud Config to a version that resolves this vulnerability.
Fixed in 4.3.2
Upgrade
Upgrade Spring Cloud Config to a version that resolves this vulnerability.
Fixed in 5.0.2

Event History

Mar 24, 2026

CVE Published

via MITRE·12:16 AM

Data Sourced

via MITRE·12:16 AM

DescriptionSeverity

Data Sourced

via NVD·01:17 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-22739?

CVE-2026-22739 is classified as a high severity vulnerability due to potential unintended access to sensitive files and the ability to conduct SSRF attacks.

How do I fix CVE-2026-22739?