What is GHSA-j6hh-h3cf-c2hf?

GHSA-j6hh-h3cf-c2hf is a security advisory published by GitHub Security Advisories with Medium severity. Spring Cloud Config Server Logged Sensitive Information

Which CVE IDs does GHSA-j6hh-h3cf-c2hf cover?

GHSA-j6hh-h3cf-c2hf covers the following CVE IDs: CVE-2026-41004. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j6hh-h3cf-c2hf?

GHSA-j6hh-h3cf-c2hf has a CVSS v3 base score of 4.4, published by GitHub Security Advisories.

Which products are affected by GHSA-j6hh-h3cf-c2hf?

GHSA-j6hh-h3cf-c2hf affects 6 products, including: maven/org.springframework.cloud:spring-cloud-config-server:\u003e= 3.1.0, \u003c= 3.1.13; maven/org.springframework.cloud:spring-cloud-config-server:\u003e= 4.1.0, \u003c= 4.1.9; maven/org.springframework.cloud:spring-cloud-config-server:\u003e= 4.2.0, \u003c= 4.2.6; maven/org.springframework.cloud:spring-cloud-config-server:\u003e= 4.3.0, \u003c= 4.3.2; maven/org.springframework.cloud:spring-cloud-config-server:\u003e= 5.0.0, \u003c= 5.0.2; and others — see the full list on the advisory page.

GHSA-j6hh-h3cf-c2hfMediumCVSS 4.4

Spring Cloud Config Server Logged Sensitive Information

Vendor

GitHub Security Advisories

Published

May 7, 2026

Last Modified

June 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-41004 →

📋 Description

When trace logging is enabled in Spring Cloud Config Server, sensitive information is placed in plain text in the logs.

Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 (inclusive); no open-source upgrade available.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); no open-source upgrade available.
Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); no open-source upgrade available.
Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); no open-source upgrade available.
Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater.
Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

🎯 Affected products6

maven/org.springframework.cloud:spring-cloud-config-server:>= 3.1.0, <= 3.1.13
maven/org.springframework.cloud:spring-cloud-config-server:>= 4.1.0, <= 4.1.9
maven/org.springframework.cloud:spring-cloud-config-server:>= 4.2.0, <= 4.2.6
maven/org.springframework.cloud:spring-cloud-config-server:>= 4.3.0, <= 4.3.2
maven/org.springframework.cloud:spring-cloud-config-server:>= 5.0.0, <= 5.0.2
maven/org.springframework.cloud:spring-cloud-config-server:>= 3.0.0, <= 3.0.7

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products6

🔗 References (3)