Spring Cloud Config 3.0.x Release Notes

Security Fixes

• A * or ? in the application, profile or label segment of a request, percent-encoded or not, is no longer accepted by PathUtils.isInvalidLocation on any backend, so a caller can no longer widen a search location into a directory glob and read configuration outside the label it asked for (medium severity, CVE-2026-47894).
• A file: repository URI whose path traverses a symbolic link at any component is no longer accepted by SvnKitEnvironmentRepository, so an SVN working-copy path can no longer be swapped for a symlink between validation and the SVNKit filesystem operations that follow it (high severity, CVE-2026-47836).
  • Behaviour change affecting the Git backend as well as SVN. Validation of file: repository URIs is now stricter: a file: URI whose path contains a symbolic link at any component is rejected, where previously only a symlink at the repository root or .git/.svn entry was. Deployments that point spring.cloud.config.server.git.uri or spring.cloud.config.server.svn.uri at a file: path traversing a symlinked directory must reconfigure it to a concrete, non-symlinked path; otherwise the first config request fails, or startup fails if the server reads its own configuration from that repository (spring.cloud.config.server.bootstrap=true).
  • The existing Git-backend symlink helpers are relocated verbatim into a shared ScmFileUtils with no behaviour change of their own.
• A heavily dashed monitor webhook path can no longer drive unbounded candidate generation in PropertyPathEndpoint, which now stops resolving service names once the path exceeds a configurable maximum number of dashes (spring.cloud.config.server.monitor.max-dashes, 20 by default) (medium severity, CVE-2026-59315).
• Unsigned webhook notifications sent to /monitor are no longer accepted, because WebhookValidatorFilter now rejects with 403 any request that no configured WebhookRequestValidator both matches and validates, so a spring.cloud.config.server.monitor.<provider>.webhookSecret must be configured before refresh events are published (medium severity, CVE-2026-47837).

Dependency Upgrades

• Spring Cloud Build (NES) 3.0.5-spring-cloud-build-3.0.8
• Spring Cloud Bus (NES) 3.0.3-spring-cloud-bus-3.0.6
• Spring Cloud Commons (NES) 3.0.6-spring-cloud-commons-3.0.9
• Spring Vault (NES) 2.3.4-spring-vault-2.3.16

Security Fixes

• Directory traversal in spring-cloud-config-server resource lookups hardened with name, profile, and path validation (CVE-2026-40982).
• File system manipulation hardened when using Git-backed repositories (CVE-2026-41002).
• AWS CodeCommit credential provider no longer logs credentials at trace level (CVE-2026-41004).

Security Fixes

• Spring Cloud Config profile substitution can allow unintended access to files and enable SSRF attacks (CVE-2026-22739).

Security Fixes

• Under certain conditions, the Vault token header may not be used in client requests to Vault (CVE-2025-22232).

Notes

• This release originates from the open‑source Spring Cloud Config repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Cloud Config 3.0.7.

Dependency Upgrades

• Spring Cloud Build (NES) 3.0.5-spring-cloud-build-3.0.6
• Spring Cloud Bus (NES) 3.0.3-spring-cloud-bus-3.0.4
• Spring Cloud Commons (NES) 3.0.6-spring-cloud-commons-3.0.7
• Spring Vault (NES) 2.3.4-spring-vault-2.3.12