CVE-2026-47894 is a medium severity (CVSS 4.9) flaw in Spring Cloud Config Server. The native environment repository can expose configuration files outside the configured repository path. The open source fix is Spring Cloud Config 5.0.5. The steps below show how to check your version and what to change.
What's affected
The affected ranges match between Spring's advisory and the record.
- Spring Cloud Config 5.0.0 to 5.0.4. Fixed in 5.0.5 (open source).
- Spring Cloud Config 4.3.0 to 4.3.4. Fixed in 4.3.5 (Enterprise Support only).
- Spring Cloud Config 4.0.0 to 4.2.8. Fixed in 4.2.9 (Enterprise Support only).
- Spring Cloud Config 3.1.14 and earlier. Fixed in 3.1.15 (Enterprise Support only).
Spring rates it Medium and states that no further mitigation steps are necessary beyond upgrading. The record carries no CWE for this CVE, so this article does not assign one.
How to check if you're exposed
For Maven projects, print the resolved version:
mvn dependency:tree | grep spring-cloud-config-server
For Gradle projects:
./gradlew dependencies | grep spring-cloud-config-server
Check the transitive tree, not only your direct dependencies, because Spring components often arrive through a starter or a parent BOM.
Then check whether your Config Server uses the native profile, which serves files from the local filesystem. Look for spring.profiles.active=native or a native search location in your configuration. If you serve configuration from Git only, the described path does not apply to you in the same way.
What to do now
- Upgrade to Spring Cloud Config 5.0.5 or the fixed release for your line.
- Review what files exist on the Config Server host near the configured native search locations. Anything readable by the service account could be in scope.
- Keep secrets out of configuration files where possible, and use encryption or a secrets manager for values that must exist.
- Restrict network access to the Config Server so only your applications can reach it.
Why it matters
The advisory is short. It says the native environment repository can expose configuration files outside the repository path it was set up to serve. That is a path confinement problem, where a boundary the operator thought was in place does not hold.
Configuration servers hold some of the most sensitive files in an environment, such as connection strings and keys. Even a medium rated read exposure can be useful to an attacker, which is why the advice to keep secrets out of plain files is worth following. The record does not mark this CVE as known exploited.
Quick check
Does the fix need a configuration change?
Spring says no further mitigation steps are necessary beyond upgrading.
Why does a medium issue still deserve attention?
Config servers often sit near credentials. A file exposure there can matter more than the base score suggests.
Sources
Last reviewed: 18 October 2026.
