Detections
Analytics
SCA: security update for org.springframework.cloud:spring-cloud-config-server (GHSA-2mh5-3cw6-hrrq)
high Tenable Cloud Security Plugin ID 443091
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a
request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud
Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise
Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10
or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6
(inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected
from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected
from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater. (CVE-2026-40981)
Solution
Update the org.springframework.cloud:spring-cloud-config-server library and its related packages to version 4.3.3 or later.See Also
Plugin Details
Severity: High
ID: 443091
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 6/11/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.75
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N
CVSS Score Source: CVE-2026-40981
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/7/2026
Vulnerability Publication Date: 5/7/2026
Reference Information
CVE: CVE-2026-40981
cwe: CWE-639