CVE-2026-47837: Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
Published Aug 26, 2026
·Updated
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated.
This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.
Affected Software
1 affected component
Spring Spring Cloud Config>=5.0.0<=5.0.4, >=4.3.0<=4.3.4, >=4.0.0<=4.2.8, <=3.1.14
Event History
Aug 26, 2026
CVE Published
via MITRE·05:08 PM
Data Sourced
via MITRE·05:08 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The CVSS vector rates the attack as network-accessible, with low attack complexity, no user interaction, and high privileges required.
2
What is the expected security impact?
The CVSS assessment indicates high availability impact and a scope change. It does not identify confidentiality or integrity impact.
3
Which release lines are affected?
Affected releases are Spring Cloud Config 5.0.0 through 5.0.4, 4.3.0 through 4.3.4, 4.0.0 through 4.2.8, and releases through 3.1.14.