# CVE-2026-41004: VMware Spring Cloud Config sensitive information disclosure in logs

Source: https://junglewise.ai/threats/cve-2026-41004-vmware-spring-cloud-config-sensitive-information-disclosure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-06-18  
License: CC BY 4.0 with a link back

CVE-2026-41004 · Severity: medium · CVSS 4.4 · Published 2026-05-07

Spring Cloud Config Server, a tool used to manage configuration settings for distributed applications, may inadvertently record sensitive information in plain text when high-level diagnostic logging is enabled. If an unauthorized person gains access to these log files, they could potentially view secrets or credentials intended to be protected. This risk is primarily relevant to organizations that have enabled 'trace' level logging in their production or staging environments.

Technologies: [org.springframework.cloud:spring-cloud-config-server (Maven)](https://junglewise.ai/threats/technologies/org-springframework-cloud-spring-cloud-config-server), [VMware Spring Cloud Config](https://junglewise.ai/threats/technologies/spring-cloud-config). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41004 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41004 being exploited in the wild.

**How severe is CVE-2026-41004?** Medium severity, with a CVSS score of 4.4, published 7 May 2026.

**Which products and versions are affected?** org.springframework.cloud:spring-cloud-config-server (Maven) ECOSYSTEM:introduced=3.1.0,last_affected=3.1.13; VMware Spring Cloud Config 3.1.0 through 3.1.13, 4.1.0 through 4.1.9, 4.2.0 through 4.2.6, 4.3.0 through 4.3.2, 5.0.0 through 5.0.2.

**Is there a fix for CVE-2026-41004?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41004 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-41004?** Check whether you run org.springframework.cloud:spring-cloud-config-server (Maven) or VMware Spring Cloud Config at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Spring Cloud Config Server is vulnerable to sensitive information disclosure (CWE-532) when the logging level is set to 'trace'. In this configuration, the application writes sensitive data in plain text to the log files. An attacker with high privileges and local access to the log files could retrieve this information, leading to a loss of confidentiality. The vulnerability affects multiple major versions; patches are available for the 4.3.x and 5.0.x branches, while older versions (3.0.x, 3.1.x, 4.1.x, 4.2.x) currently have no open-source upgrade path. Security engineers should ensure trace logging is disabled in sensitive environments or upgrade to versions 4.3.3, 5.0.3, or later.

## Affected products

- Spring Spring Cloud Config Server 3.0.0-3.0.7, 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, 5.0.0-5.0.2

## Identifiers

- CVE-2026-41004
- GHSA-j6hh-h3cf-c2hf

## Timeline

- 2026-05-07: disclosed
- 2026-05-07: advisory

## References

- [https://api.github.com/users/scottfrederick](https://api.github.com/users/scottfrederick)
- [https://github.com/scottfrederick](https://github.com/scottfrederick)
- [https://api.github.com/users/scottfrederick/gists%7B/gist_id%7D](https://api.github.com/users/scottfrederick/gists%7B/gist_id%7D)
- [https://api.github.com/users/scottfrederick/repos](https://api.github.com/users/scottfrederick/repos)
- [https://avatars.githubusercontent.com/u/60661?v=4](https://avatars.githubusercontent.com/u/60661?v=4)
- [https://api.github.com/users/scottfrederick/events%7B/privacy%7D](https://api.github.com/users/scottfrederick/events%7B/privacy%7D)

## Related threats

- [Spring Cloud Config Server SVN base directory TOCTOU vulnerability](https://junglewise.ai/threats/cve-2026-47836-spring-cloud-config-server-svn-base-directory-toctou)
- [VMware Spring Cloud Config TOCTOU in Git base directory](https://junglewise.ai/threats/cve-2026-41002-vmware-spring-cloud-config-toctou-in-git-base-directory)
- [VMware Spring Cloud Config directory traversal in spring-cloud-config-server](https://junglewise.ai/threats/cve-2026-40982-vmware-spring-cloud-config-directory-traversal-in-spring-cloud)
- [VMware Spring Cloud Config auth bypass in Google Secrets Manager backend](https://junglewise.ai/threats/cve-2026-40981-vmware-spring-cloud-config-auth-bypass-in-google-secrets-manager)
- [Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access](https://junglewise.ai/threats/cve-2026-22739-spring-cloud-config-server-path-traversal-via-profile-parameter)