CVE Explorer

CVE-2026-41004

When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:cba29f14e76756c1590f7634142c4ef83016e3d6ba2c192b35d576ae1f56d356

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Spring Cloud Config","vendor":"Spring","versions":[{"lessThan":"3.1.14","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"4.1.10","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.7","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.3","status":"affected","version":"4.3.0","versionType":"custom"},{"lessThan":"5.0.3","status":"affected","version":"5.0.0","versionType":"custom"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:11274da4f37587edf621d10fcd7a0ebd20071fcf37a5b2cbf7c8079a51a4d587 · sha256:e3d450e4c7b301d7… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:11274da4f37587edf621d10fcd7a0ebd20071fcf37a5b2cbf7c8079a51a4d587 · sha256:e3d450e4c7b301d7… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-532","description":"CWE-532: Insertion of Sensitive Information into Log File","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:11274da4f37587edf621d10fcd7a0ebd20071fcf37a5b2cbf7c8079a51a4d587 · sha256:e3d450e4c7b301d7… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"url":"https://spring.io/security/cve-2026-41004"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:11274da4f37587edf621d10fcd7a0ebd20071fcf37a5b2cbf7c8079a51a4d587 · sha256:e3d450e4c7b301d7… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer