Executive brief
Spring Cloud Config Server, a tool used to manage configuration settings for distributed applications, may inadvertently record sensitive information in plain text when high-level diagnostic logging is enabled. If an unauthorized person gains access to these log files, they could potentially view secrets or credentials intended to be protected. This risk is primarily relevant to organizations that have enabled 'trace' level logging in their production or staging environments.
Technical details
Spring Cloud Config Server is vulnerable to sensitive information disclosure (CWE-532) when the logging level is set to 'trace'. In this configuration, the application writes sensitive data in plain text to the log files. An attacker with high privileges and local access to the log files could retrieve this information, leading to a loss of confidentiality. The vulnerability affects multiple major versions; patches are available for the 4.3.x and 5.0.x branches, while older versions (3.0.x, 3.1.x, 4.1.x, 4.2.x) currently have no open-source upgrade path. Security engineers should ensure trace logging is disabled in sensitive environments or upgrade to versions 4.3.3, 5.0.3, or later.
Affected products
- Spring Spring Cloud Config Server 3.0.0-3.0.7, 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, 5.0.0-5.0.2
Timeline
- 2026-05-07: disclosed
- 2026-05-07: advisory
References
- https://api.github.com/users/scottfrederick
- https://github.com/scottfrederick
- https://api.github.com/users/scottfrederick/gists%7B/gist_id%7D
- https://api.github.com/users/scottfrederick/repos
- https://avatars.githubusercontent.com/u/60661?v=4
- https://api.github.com/users/scottfrederick/events%7B/privacy%7D