CVE-2026-47837: vmware spring_cloud_config

CVSS 9.8 (critical) · published 2026-08-26

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.

Affected products (NVD): vmware spring_cloud_config

Fixed in (NVD): 3.1.15, 4.2.9, 4.3.5, 5.0.5

Weakness: CWE-306

Source: NVD CVE-2026-47837

References

• https://spring.io/security/cve-2026-47837

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.