Loading vulnerability…
Spring Cloud Config Server Profile Parameter Path Traversal and SSRF
CVE-2026-22739 is an improper path-limitation vulnerability in Spring Cloud Config Server's substitution of the request-supplied profile parameter. When Config Server uses the native file-system backend, crafted profile values can cause access to files outside configured search directories. When a source-control backend is used, profile substitution into the source-control repository URL can be abused to make server-side requests to attacker-selected destinations. Affected versions are Spring Cloud 3.1.x before 3.1.13, 4.1.x before 4.1.9, 4.2.x before 4.2.3, 4.3.x before 4.3.2, and 5.0.x before 5.0.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated network attacker may read or otherwise access files outside the Config Server's intended configuration search paths when the native file-system backend is enabled. The issue has high confidentiality impact and low integrity and availability impact. In source-control-backed deployments, exploitation may enable SSRF, allowing requests from the Config Server's network position to unintended or internal destinations.
If you can’t patch tonight, do this now.
Until upgraded, restrict Config Server network exposure to trusted clients and isolate the service from sensitive local files and internal network resources. Where feasible, avoid the native file-system backend and prevent user-controlled profile values from influencing source-control repository URLs. Apply egress restrictions to reduce SSRF reachability.
Patch, then assume compromise.
Upgrade Spring Cloud Config Server to 3.1.13 or later, 4.1.9 or later, 4.2.3 or later, 4.3.2 or later, or 5.0.2 or later, as applicable to the deployed release line.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.