Blog
Everything You Need to Know About the Spring Cloud Vulnerability
This is a HivePro security advisory for CVE-2026-40982, a critical (CVSS 9.8) path traversal flaw in Spring Cloud Config Server's ResourceController.
The core problem: a prior fix (CVE-2026-22739) only protected the profile parameter in one controller, leaving three sibling parameters — name, label, and path — unchecked in an adjacent controller. An unauthenticated attacker can send a single crafted HTTP GET request with a traversal sequence in any of those three variables and read arbitrary files off the server. No credentials, no user interaction, network access only. Deployments using a custom ResourceRepository are most exposed, since the built-in repository's fallback check doesn't apply to them.
Why it matters: Config Server is the "master keyring" for a microservice mesh, so one file read typically hands over database passwords, cloud provider keys, and JWT signing secrets — enough to pivot into every downstream system, with regulatory fallout under GDPR, HIPAA, PCI-DSS, and SOC 2 / ISO 27001.
The bigger narrative is a seven-year pattern: five CVEs in the same module, each fix scoped narrowly to the reported parameter while leaving adjacent ones open. HivePro found this one during BAS exploit development, disclosed it responsibly, and Spring patched all five affected branches (3.1.14 / 4.1.10 / 4.2.7 / 4.3.3 / 5.0.3) within 13 days — before public disclosure, no known exploitation.
Recommendation: patch immediately, audit any custom ResourceRepository for path validation, and lock down network exposure regardless of patch status.
