CVE-2026-47894

CVE-2026-47894

Medium · published August 27, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
40.9
In the wild
Unconfirmed
What it is

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path.

Spring Cloud Config 5.0.0 - 5.0.4

Spring Cloud Config 4.3.0 - 4.3.4

Spring Cloud Config 4.0.0 - 4.2.8

Spring Cloud Config 3.1.14 and earlier

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00486 · 40.9th percentile
Published
2026-08-27T10:17Z
Affected products (4)
ProductVersionsFixed in
vmware/spring_cloud_config< 3.1.153.1.15
vmware/spring_cloud_config≥ 4.0.0, < 4.2.94.2.9
vmware/spring_cloud_config≥ 4.3.0, < 4.3.54.3.5
vmware/spring_cloud_config≥ 5.0.0, < 5.0.55.0.5
References (1)
https://spring.io/security/cve-2026-47894 · [email protected]
EPSS history
Timeline
  • 28 AUG 06:43Z
    EPSS moved — → 0%
    epss
  • 27 AUG 05:20Z
    Spring Cloud Config Server Native Environment Repository Exposure
    cvelistv5