CVE-2026-22739: 
Java vulnerability analysis and mitigation

CVE-2026-22739 is a path traversal and SSRF vulnerability in Spring Cloud Config Server that allows unauthenticated attackers to access files outside of configured search directories and perform Server-Side Request Forgery (SSRF) attacks. It was discovered by Hyunwoo Kim (@V4bel), disclosed on March 23–24, 2026, and affects Spring Cloud Config versions 3.1.x before 3.1.13, 4.1.x before 4.1.9, 4.2.x before 4.2.6, 4.3.x before 4.3.2, and 5.0.x before 5.0.2; older unsupported versions are also affected. It carries a CVSS v3.1 base score of 8.6 (High) (Spring Advisory, Feedly).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22 — Path Traversal). When Spring Cloud Config Server is configured to use the native file system as a backend, the profile parameter from incoming requests is substituted without sufficient sanitization, allowing an attacker to traverse outside the configured search directories and read arbitrary files. Additionally, when a source control backend (e.g., Git) is used, the unsanitized profile parameter can be injected into the repository URL, enabling SSRF attacks against internal or external services. No authentication is required to exploit either attack vector (Spring Advisory, Security Online).

An unauthenticated remote attacker can read arbitrary files from the server's filesystem beyond the intended configuration directories, potentially exposing sensitive data such as credentials, private keys, application secrets, and system files. When a source control backend is in use, the SSRF vector allows attackers to make the Config Server issue requests to internal network resources, potentially enabling reconnaissance or exploitation of internal services. The vulnerability carries high confidentiality impact with low integrity and availability impacts (Spring Advisory, Feedly).

As of the time of disclosure, no public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation. However, a Nuclei detection template was added to the ProjectDiscovery nuclei-templates repository, lowering the barrier for automated scanning (Nuclei Templates). The EPSS score is approximately 0.017% (very low probability of exploitation in the near term). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability requires no authentication and no user interaction, making it trivially exploitable once a target is identified (Feedly, Spring Advisory).

1. Reconnaissance: Identify internet-facing Spring Cloud Config Server instances using tools like Shodan, Censys, or the available Nuclei template, targeting endpoints such as /{application}/{profile} or /{application}/{profile}/{label}.
2. Determine backend type: Probe the Config Server to determine whether it uses a native filesystem backend or a source control (e.g., Git) backend, as the attack path differs.
3. Path traversal (native filesystem backend): Craft a request with a malicious profile parameter containing path traversal sequences (e.g., ../../etc/passwd) to read files outside the configured search directories. Example: GET /application/../../etc/passwd HTTP/1.1.
4. SSRF (source control backend): Inject a crafted value into the profile parameter that modifies the repository URL to point to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata), causing the Config Server to issue a request to that internal endpoint.
5. Exfiltrate data: Review the Config Server's response to extract file contents (credentials, keys, configuration secrets) or SSRF response data for further lateral movement (Spring Advisory, Security Online).

• Network: Unusual HTTP requests to Config Server endpoints (e.g., /{application}/{profile}) with profile values containing ../, %2e%2e%2f, or URL-encoded traversal sequences; outbound HTTP requests from the Config Server to internal IP ranges (e.g., 169.254.169.254, RFC1918 addresses) indicating SSRF exploitation.
• Logs: Access logs showing repeated requests to Config Server endpoints with anomalous profile parameter values (e.g., containing .., encoded slashes, or internal hostnames); HTTP 200 responses to requests with traversal patterns that should have been rejected.
• File System: No direct file system artifacts expected on the attacker side; on the server, review for unexpected file access patterns in OS-level audit logs (e.g., auditd on Linux) showing the Config Server JVM process reading files outside the configured search path.
• Process: Unusual outbound network connections initiated by the Spring Cloud Config Server Java process to internal or unexpected external hosts (Spring Advisory, Security Online).

Users should upgrade Spring Cloud Config Server to the corresponding fixed version: 3.1.13 (Enterprise Support only), 4.1.9 (Enterprise Support only), 4.2.6 (Enterprise Support only), 4.3.2 (OSS), or 5.0.2 (OSS). As a network-level workaround, restrict access to Config Server endpoints using firewalls or API gateways to limit exposure to trusted clients only. Additionally, review access logs for suspicious profile parameter values that may indicate prior exploitation attempts (Spring Advisory, Canadian CCCS Advisory).

The Spring team published an official security advisory on March 23, 2026, crediting researcher Hyunwoo Kim (@V4bel) for responsible disclosure (Spring Advisory). The Canadian Centre for Cyber Security (CCCS) issued an advisory (AV26-288) recommending immediate patching (Canadian CCCS Advisory). HeroDevs published a March 2026 Spring CVE roundup covering this and related vulnerabilities, and Security Online highlighted the dual path traversal and SSRF nature of the flaw (HeroDevs Blog, Security Online). Community activity included a Nuclei detection template being added and discussed on GitHub, and brief social media mentions on Bluesky.