CVE-2026-47837 is a missing authentication flaw in Spring Cloud Config Server, scored CVSS 6.8 (medium). Webhook requests to the /monitor endpoint are not validated. Spring fixed it in 5.0.5 for open source users. Other lines have fixes through enterprise support only, so check the Spring advisory for your line.
What's affected
The Spring advisory lists these affected versions of Spring Cloud Config:
- 5.0.0 through 5.0.4
- 4.3.0 through 4.3.4
- 4.0.0 through 4.2.8
- 3.1.14 and earlier
Fixed versions:
- 5.0.5, open source
- 4.3.5, Enterprise Support only
- 4.2.9, Enterprise Support only
- 3.1.15, Enterprise Support only
The advisory says no further mitigation is needed after upgrading. The vector in the NVD record is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H. It lists high privileges required and an availability impact, which explains the medium score.
How to check if you're exposed
Find the Spring Cloud Config Server version in your build.
Maven:
mvn dependency:tree -Dincludes=org.springframework.cloud:spring-cloud-config-server
Gradle:
gradle dependencies | grep spring-cloud-config-server
Spring Cloud Config is usually managed through the Spring Cloud release train, so also check which train version your project imports.
Then check whether the monitor endpoint is enabled. The endpoint receives push notifications from your Git host so the server can refresh configuration. If you do not use webhooks, the endpoint may not be part of your setup, but confirm that in your configuration rather than assume it.
What to do now
- Find every Config Server instance and its version.
- Upgrade to 5.0.5 for the 5.0 line. If you run an older line, talk to Spring about an enterprise release or move to a supported one.
- Restart the servers and confirm the new version is in use.
- Restrict network access to the /monitor endpoint to your Git host's addresses as a general precaution.
- Check that webhook configuration points only to systems you control.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. The advisory says webhook requests to the monitor endpoint are not validated, so the server acts on a request without checking where it came from.
The rating is medium because the record assumes the attacker needs privileges and the effect is on availability. Config servers sit at the center of many deployments, since every client reads its settings from them, so interruptions can spread. The record's KEV flag is false.
Quick check
Is CVE-2026-47837 exploited in the wild?
The record's KEV flag is false, and the pages I read do not say it is exploited. Treat it as a patch item and keep an eye on the advisory for changes.
My version line only has an enterprise fix. What now?
The advisory lists fixes for 4.3, 4.2 and 3.1 under Enterprise Support only. Contact Spring about access or move to the 5.0 line, which has an open source fix.
Sources
Last reviewed: 19 October 2026.
