Executive brief
Spring Cloud Config is a centralized configuration management system used by enterprises to distribute settings and secrets across microservices. The /monitor endpoint, which processes webhook notifications from external systems, lacks authentication checks, allowing unauthenticated attackers to trigger configuration refresh actions remotely and potentially expose or modify application configurations.
Technical details
This is a missing authentication vulnerability (CWE-306) in the /monitor webhook endpoint of Spring Cloud Config Server. The endpoint accepts POST requests without validating the caller's identity or authorization, allowing any network-accessible attacker to submit webhook payloads. An unauthenticated attacker can trigger configuration repository refresh operations, potentially leading to configuration exposure, denial of service, or if the configuration repository is compromised, arbitrary configuration injection. Affected versions include 5.0.0–5.0.4, 4.3.0–4.3.4, 4.0.0–4.2.8, and 3.1.14 and earlier; patches are expected from VMware/Spring.
Affected products
- Spring Spring Cloud Config 5.0.0 through 5.0.4, 4.3.0 through 4.3.4, 4.0.0 through 4.2.8, and through 3.1.14
Timeline
- 2026-08-26: disclosed