Spring Cloud Config Vulnerability Allows Server-Side Request Forgery

CERT-FR Security Advisories

Published March 24th, 2026

Detected March 24th, 2026

Summary

CERT-FR has issued an advisory regarding a critical vulnerability (CVE-2026-22739) in Spring Cloud Config versions prior to 3.1.13, 4.1.9, 4.2.6, 4.3.2, and 5.0.2. The vulnerability allows for Server-Side Request Forgery (SSRF), enabling attackers to potentially compromise server security.

View original document View source feed page

What changed

CERT-FR has released an advisory (CERTFR-2026-AVI-0343) detailing a critical Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2026-22739, affecting multiple versions of Spring Cloud Config. The affected versions include 3.1.x prior to 3.1.13, 4.1.x prior to 4.1.9, 4.2.x prior to 4.2.6, 4.3.x prior to 4.3.2, and 5.0.x prior to 5.0.2. This vulnerability could allow an attacker to execute arbitrary requests on behalf of the server.

Organizations utilizing the affected versions of Spring Cloud Config must consult the vendor's security bulletin for patch information and apply the necessary updates immediately to mitigate the SSRF risk. Failure to do so could lead to unauthorized access and potential system compromise. The advisory references the official Spring security bulletin and CVE record for detailed remediation steps.

What to do next

Consult Spring's security bulletin for CVE-2026-22739.
Apply available patches to affected Spring Cloud Config versions.
Review server configurations for signs of compromise.

Source document (simplified)

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 24 mars 2026 N° CERTFR-2026-AVI-0343 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Vulnérabilité dans Spring Cloud Config

Gestion du document

Risque

Falsification de requêtes côté serveur (SSRF)

Systèmes affectés

Cloud Config versions 3.1.x antérieures à 3.1.13
Cloud Config versions 4.1.x antérieures à 4.1.9
Cloud Config versions 4.2.x antérieures à 4.2.6
Cloud Config versions 4.3.x antérieures à 4.3.2
Cloud Config versions 5.0.x antérieures à 5.0.2

Résumé

Une vulnérabilité a été découverte dans Spring Cloud Config. Elle permet à un attaquant de provoquer une falsification de requêtes côté serveur (SSRF).