Executive brief
Spring Cloud Config is a service used to manage configuration settings and secrets for distributed applications. A security flaw exists when using Google Secrets Manager as a storage backend, which could allow an attacker to access sensitive information from Google Cloud projects they are not authorized to see. This could lead to the exposure of credentials, API keys, or other confidential data, potentially compromising the security of the entire cloud environment.
Technical details
A vulnerability in Spring Cloud Config (CWE-639, CWE-1220) occurs when Google Secrets Manager is utilized as the backend storage. An unauthenticated remote attacker can craft malicious requests to the configuration server to bypass intended access controls. This allows for the unauthorized retrieval of secrets from GCP projects other than the one intended for the specific application context. The issue stems from insufficient granularity in access control and authorization bypass through user-controlled keys. Patches are available in versions 3.1.14, 4.1.10, 4.2.7, 4.3.3, and 5.0.3.
Affected products
- VMware Spring Cloud Config 3.1.0 through 3.1.13, 4.1.0 through 4.1.9, 4.2.0 through 4.2.6, 4.3.0 through 4.3.2, 5.0.0 through 5.0.2
Timeline
- 2026-05-07: disclosed
- 2026-05-07: advisory