This vulnerability (CVE-2026-40981) involves an authorization bypass through a user-controlled key in Spring Cloud Config when configured to use Google Secrets Manager as the backend. An attacker can craft requests to the config server that potentially expose secrets belonging to unintended GCP projects. Affected versions include Spring Cloud Config 3.1.0 through 3.1.13, 4.1.0 through 4.1.9, 4.2.0 through 4.2.6, 4.3.0 through 4.3.2, and 5.0.0 through 5.0.2. Fixed versions start from 3.1.14, 4.1.10, 4.2.7, 4.3.3, and 5.0.3 respectively. The CVSS 3.1 base score is 7.5 (High), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicating network attack vector, low complexity, no privileges or user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. The vendor advisory from Red Hat confirms the vulnerability and the availability of patches. The service is cloud-hosted, so vendor-managed remediation is typical.

Successful exploitation allows an unauthenticated attacker to bypass authorization controls and access sensitive secrets from unintended Google Cloud Platform projects via the Spring Cloud Config server. This results in a high confidentiality impact, potentially exposing critical credentials or configuration data. There is no impact on integrity or availability. The vulnerability affects multiple Spring Cloud Config versions across several major releases.

Patches are available and should be applied to upgrade affected Spring Cloud Config versions to the fixed releases: 3.1.14 or later (Enterprise Support Only), 4.1.10 or later (Enterprise Support Only), 4.2.7 or later (Enterprise Support Only), 4.3.3 or later, and 5.0.3 or later. Since this is a cloud-hosted service, the vendor typically manages remediation server-side. Users should consult the vendor advisory (https://access.redhat.com/security/cve/CVE-2026-40981) for detailed patching instructions and confirm that their environment is updated accordingly.