CVE-2026-47837: CWE-306 Missing Authentication for Critical Function in Spring Spring Cloud Config

The vulnerability identified as CVE-2026-47837 in Spring Cloud Config involves missing authentication on the /monitor endpoint. This allows unauthenticated webhook requests to be accepted by the server, potentially leading to denial of service or other availability impacts. The affected versions include 3.1.14 and all versions from 4.0.0 through 4.2.8, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.4. The CVSS 3.1 base score is 6.8 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, indicating network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, no confidentiality or integrity impact, and high availability impact. There is no vendor advisory or patch information available at this time.

The vulnerability allows unauthenticated webhook requests to the /monitor endpoint of Spring Cloud Config Server, which can result in denial of service or disruption of availability. There is no direct confidentiality or integrity impact reported. Exploitation requires high privileges, but once exploited, it can affect the availability of the service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the /monitor endpoint through network controls or authentication proxies to mitigate unauthorized webhook requests.