The Hive Blog

Request a demo to make cybersecurity risk quantification actionable, prioritize exposure, and communicate financial impact to your board.

Request a security demo today. Learn the true cost of unpatched vulnerabilities and how they lead to devastating data breaches and high recovery expenses.

Request a Continuous Threat Exposure Management evaluation. Understand how the cost of unpatched vulnerabilities leads to data breach financial damage.

Schedule a demo with Hive Pro. Discover modern cybersecurity metrics beyond MTTR to prioritize threat exposure, validate controls, and demonstrate business value.

Request a Uni5 Xposure demo and strengthen third party vendor risk management cybersecurity with continuous monitoring and threat intelligence.

This is a HivePro security advisory for CVE-2026-40982, a critical (CVSS 9.8) path traversal flaw in Spring Cloud Config Server's ResourceController. The core problem: a prior fix (CVE-2026-22739) only protected the profile parameter in one controller, leaving three sibling parameters — name, label, and path — unchecked in an adjacent controller. An unauthenticated attacker can send a single crafted HTTP GET request with a traversal sequence in any of those three variables and read arbitrary files off the server. No credentials, no user interaction, network access only. Deployments using a custom ResourceRepository are most exposed, since the built-in repository's fallback check doesn't apply to them. Why it matters: Config Server is the "master keyring" for a microservice mesh, so one file read typically hands over database passwords, cloud provider keys, and JWT signing secrets — enough to pivot into every downstream system, with regulatory fallout under GDPR, HIPAA, PCI-DSS, and SOC 2 / ISO 27001. The bigger narrative is a seven-year pattern: five CVEs in the same module, each fix scoped narrowly to the reported parameter while leaving adjacent ones open. HivePro found this one during BAS exploit development, disclosed it responsibly, and Spring patched all five affected branches (3.1.14 / 4.1.10 / 4.2.7 / 4.3.3 / 5.0.3) within 13 days — before public disclosure, no known exploitation. Recommendation: patch immediately, audit any custom ResourceRepository for path validation, and lock down network exposure regardless of patch status.