CVE-2026-47837
published 2026-08-26CVE-2026-47837: Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.55%
45.9th percentile
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated.
This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_cloud_config | <= 3.1.14 | — |
| spring | spring_cloud_config | 4.0.0 – 4.2.8 | — |
| spring | spring_cloud_config | 4.3.0 – 4.3.4 | — |
| spring | spring_cloud_config | 5.0.0 – 5.0.4 | — |
| vmware | spring_cloud_config | < 3.1.15 | 3.1.15 |
| vmware | spring_cloud_config | >= 4.0.0 < 4.2.9 | 4.2.9 |
| vmware | spring_cloud_config | >= 4.3.0 < 4.3.5 | 4.3.5 |
| vmware | spring_cloud_config | >= 5.0.0 < 5.0.5 | 5.0.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Spring Cloud Config up to 3.1.14/4.2.8/4.3.4/5.0.4 Monitor Endpoint missing authentication (WID-SEC-2026-2952)
vuldb·2026-09-06·CVSS 9.8
CVE-2026-47837 [CRITICAL] Spring Cloud Config up to 3.1.14/4.2.8/4.3.4/5.0.4 Monitor Endpoint missing authentication (WID-SEC-2026-2952)
A vulnerability classified as problematic has been found in Spring Cloud Config up to 3.1.14/4.2.8/4.3.4/5.0.4. The impacted element is an unknown function of the component Monitor Endpoint. Performing a manipulation results in missing authentication.
This vulnerability is cataloged as CVE-2026-47837. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated.
ghsa_unreviewed·2026-08-26
CVE-2026-47837 [MEDIUM] CWE-306 Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated.
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated.
This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-47837 log4j: Spring Cloud Config Server: Denial of Service via unauthenticated monitor endpoint [fedora-all]
bugzilla·2026-09-09·CVSS 9.8
CVE-2026-47837 [CRITICAL] CVE-2026-47837 log4j: Spring Cloud Config Server: Denial of Service via unauthenticated monitor endpoint [fedora-all]
CVE-2026-47837 log4j: Spring Cloud Config Server: Denial of Service via unauthenticated monitor endpoint [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated.
This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.
Bugzilla
CVE-2026-47837 org.springframework.cloud/spring-cloud-config-server: Spring Cloud Config Server: Denial of Service via unauthenticated monitor endpoint
bugzilla·2026-08-26·CVSS 9.8
CVE-2026-47837 [CRITICAL] CVE-2026-47837 org.springframework.cloud/spring-cloud-config-server: Spring Cloud Config Server: Denial of Service via unauthenticated monitor endpoint
CVE-2026-47837 org.springframework.cloud/spring-cloud-config-server: Spring Cloud Config Server: Denial of Service via unauthenticated monitor endpoint
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated.
This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.
2026-08-26
Published