This vulnerability (CVE-2026-41004) in Spring Cloud Config Server arises when trace logging is enabled, causing sensitive information to be written in plaintext within log files. Affected versions include Spring Cloud Config 3.1.0 through 3.1.13, 4.1.0 through 4.1.9, 4.2.0 through 4.2.6, 4.3.0 through 4.3.2, and 5.0.0 through 5.0.2. The issue is categorized under CWE-532 (Insertion of Sensitive Information into Log File). The CVSS v3.1 base score is 4.4 (medium severity), with attack vector local, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact. Remediation involves upgrading to fixed versions as specified per branch, with some fixes available only for Enterprise Support customers. No cloud service is involved, and no vendor advisory explicitly states the remediation level, but upgrade paths are clearly defined.

The vulnerability allows sensitive information to be exposed in plaintext logs when trace logging is enabled. This can lead to confidentiality breaches if unauthorized users gain access to these logs. The impact is limited to confidentiality; integrity and availability are not affected. Exploitation requires local access with high privileges, and no user interaction is needed. There are no known exploits in the wild at this time.

Upgrade affected Spring Cloud Config Server versions to the fixed versions: 3.1.14 or greater (Enterprise Support Only), 4.1.10 or greater (Enterprise Support Only), 4.2.7 or greater (Enterprise Support Only), 4.3.3 or greater, or 5.0.3 or greater. Avoid enabling trace logging unless necessary, and restrict access to logs to trusted personnel only. Since the vendor advisory does not explicitly state remediation level, verify with the vendor for official patches and support status. Patch status is not yet confirmed as official-fix for all versions; check the vendor advisory for current remediation guidance.