Spring Security Advisories

CVE-2026-22739: Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks

MEDIUM | MARCH 23, 2026 | CVE-2026-22739

Description

When substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, it was possible to access files outside of the configured search directories.

In addition, when using a source control backend, the profile parameter could be substituted into the URL pointing at the source control repository making it possible to perform SSRF attacks.

Affected Spring Products and Versions

Spring Cloud Config:

3.1.x
4.1.x
4.2.x
4.3.x
5.0.x
Older, unsupported versions are also affected

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)	Fix version	Availability
3.1.x	3.1.13	Enterprise Support Only
4.1.x	4.1.9	Enterprise Support Only
4.2.x	4.2.6	Enterprise Support Only
4.3.x	4.3.2	OSS
5.0.x	5.0.2	OSS

Credit

The issue was identified and responsibly reported by Hyunwoo Kim (@V4bel).

References

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L&version=3.1

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy