https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:35:34.246401+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0297 certfr-2025-avi-0297 — Une vulnérabilité a été découverte dans Spring Cloud Config. Elle permet à un attaquant de provoquer un contournement d… 2026-10-03T08:35:34.298726+00:00 certfr-2025-avi-0297 https://cve.radiocsirt.org/vuln/euvd-2026-228500 EUVD-2026-228500 2026-10-03T08:35:34.298766+00:00 EUVD-2026-228500 https://cve.radiocsirt.org/vuln/fkie_cve-2025-22232 fkie_cve-2025-22232 2026-10-03T08:35:34.298781+00:00

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: * You have Spring Vault on the classpath of your Spring Cloud Config Server and * You are using the X-CONFIG-TOKEN header to send a Vault token to the Spring Cloud Config Server for the Config Server to use when making requests to Vault and * You are using the default Spring Vault SessionManager implementation LifecycleAwareSessionManager or a SessionManager implementation that persists the Vault token such as SimpleSessionManager.

In this case the SessionManager persists the first token it retrieves and will continue to use that token even if client requests to the Spring Cloud Config Server include a X-CONFIG-TOKEN header with a different value. Affected Spring Products and Versions Spring Cloud Config: * 2.2.1.RELEASE - 4.2.1

Mitigation Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)Fix versionAvailability4.2.x4.2.2OSS4.1.x4.1.6OSS4.0.x4.0.10Commercial3.1.x3.1.10Commercial3.0.x4.1.6OSS2.2.x4.1.6OSS NOTE: Spring Cloud Config 3.0.x and 2.2.x are no longer under open source or commercial support. Users of these versions are encouraged to upgrade to a supported version.

No other mitigation steps are necessary.

 https://cve.radiocsirt.org/vuln/ghsa-qpfh-2wpm-c362 GHSA-qpfh-2wpm-c362 2026-10-03T08:35:34.298824+00:00

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: * You have Spring Vault on the classpath of your Spring Cloud Config Server and * You are using the X-CONFIG-TOKEN header to send a Vault token to the Spring Cloud Config Server for the Config Server to use when making requests to Vault and * You are using the default Spring Vault SessionManager implementation LifecycleAwareSessionManager or a SessionManager implementation that persists the Vault token such as SimpleSessionManager.

In this case the SessionManager persists the first token it retrieves and will continue to use that token even if client requests to the Spring Cloud Config Server include a X-CONFIG-TOKEN header with a different value. Affected Spring Products and Versions Spring Cloud Config: * 2.2.1.RELEASE - 4.2.1

Mitigation Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)Fix versionAvailability4.2.x4.2.2OSS4.1.x4.1.6OSS4.0.x4.0.10Commercial3.1.x3.1.10Commercial3.0.x4.1.6OSS2.2.x4.1.6OSS NOTE: Spring Cloud Config 3.0.x and 2.2.x are no longer under open source or commercial support. Users of these versions are encouraged to upgrade to a supported version.

No other mitigation steps are necessary.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0762 WID-SEC-W-2025-0762 — VMware Tanzu Spring Cloud: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-03T08:35:34.298856+00:00

Ein authentisierter Angreifer kann eine Schwachstelle in VMware Tanzu Spring Cloud ausnutzen, um Sicherheitsvorkehrungen zu umgehen.