Changeflow GovPing Data Privacy & Cybersecurity VMware Tanzu Spring Cloud Vulnerability Allows ...
Priority review Notice Amended Final

VMware Tanzu Spring Cloud Vulnerability Allows Information Disclosure

Favicon for wid.cert-bund.de CERT-Bund Security Advisories
Published
Detected
Email

Summary

CERT-Bund has issued a security advisory for VMware Tanzu Spring Cloud, detailing a vulnerability that allows remote attackers to disclose information. The advisory affects multiple versions of VMware Tanzu Spring Cloud Config and provides mitigation guidance.

View original document View source feed page

What changed

CERT-Bund has released security advisory WID-SEC-2026-0829 concerning a critical vulnerability (CVSS Base Score 8.6) in VMware Tanzu Spring Cloud. The vulnerability allows remote, anonymous attackers to disclose sensitive information. Affected products include various versions of VMware Tanzu Spring Cloud Config, specifically versions prior to 5.0.2, 4.3.2, 4.2.6, 4.1.9, and 3.1.13. The advisory notes that mitigation measures are available.

Organizations utilizing VMware Tanzu Spring Cloud Config should immediately assess their environment for the affected versions and apply available patches or mitigation strategies to prevent information disclosure. This advisory impacts Linux, UNIX, and Windows operating systems. Given the high CVSS score and remote exploitability, prompt action is recommended to secure affected systems and prevent potential data breaches.

What to do next

  1. Assess environment for affected VMware Tanzu Spring Cloud Config versions
  2. Apply available patches or mitigation strategies
  3. Review system logs for signs of exploitation

Archived snapshot

Mar 24, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

[WID-SEC-2026-0829] VMware Tanzu Spring Cloud: Schwachstelle ermöglicht Offenlegung von Informationen CVSS Base Score 8.6 (hoch) CVSS Temporal Score 7.5 (hoch) Remoteangriff ja Datum 23.03.2026 Stand 24.03.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

  • Linux
  • Sonstiges
  • UNIX
  • Windows

Produktbeschreibung

VMware Tanzu Spring Cloud ist eine Plattform zur Bereitstellung und Verwaltung von Spring-Anwendungen in Cloud-Umgebungen unter Verwendung von Microservices-Architekturen.

Produkte

23.03.2026
- VMware Tanzu Spring Cloud Config <5.0.2

  • VMware Tanzu Spring Cloud Config <4.3.2

  • VMware Tanzu Spring Cloud Config <4.2.6

  • VMware Tanzu Spring Cloud Config <4.1.9

  • VMware Tanzu Spring Cloud Config <3.1.13

Angriff

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Cloud ausnutzen, um Informationen offenzulegen. CVE Informationen Versionshistorie Feedback zum Advisory geben

Named provisions

Betroffene Systeme Angriff

Related changes

Favicon for wid.cert-bund.de Uptime Kuma Vulnerability Allows Information Disclosure
Priority review Mar 23, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de VMware Tanzu Spring Security Vulnerability
Priority review Mar 20, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de Red Hat OpenShift AI Vulnerability Enables Information Disclosure and Privilege Escalation
Urgent Apr 14, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-Bund Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for wid.cert-bund.de
CERT-Bund Security Advisories wid.cert-bund.de/content/public/securityAdvisory/rss
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-Bund
Published
March 23rd, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
WID-SEC-2026-0829

Who this affects

Applies to
Technology companies
Industry sector
5112 Software & Technology
Activity scope
Vulnerability Management Information Disclosure
Geographic scope
Germany DE

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Information Security Vulnerability Management

Browse Categories

Agriculture & Food Safety 64 AI Regulation 3 Banking & Finance 292 Consumer Protection 46 Courts & Legal 361 Data Privacy & Cybersecurity 76 Defense & National Security 51 Education 22 Energy 100 Environment 86 Environmental & Energy 11 Environmental Regulation 7 Financial Regulation 2 Government & Legislation 279 Government Operations 4 Healthcare 136 Healthcare & Life Sciences 3 Housing 16 Immigration 8 Immigration & Border Control 1 Insurance 58 Labor & Employment 113 Legal & Judicial 8 Pharma & Drug Safety 104 Public Health 2 Real Estate & Housing 3 Sanctions & Export Controls 1 Securities & Markets 103 Securities Regulation 6 Tax 65 Tax & Revenue 1 Telecom & Technology 47 Trade & Commerce 2 Trade & Sanctions 135 Transportation 60

Get alerts for this source

We'll email you when CERT-Bund Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!