Spring Cloud Config Server exposes a /monitor endpoint that accepts webhook requests without validating the caller’s identity, allowing an unauthenticated attacker to trigger monitoring actions. The flaw is classified as Missing Authentication for a Critical Function (CWE‑306), which means anyone who can reach the endpoint can potentially read or manipulate monitoring data, compromising integrity and possibly enabling further attacks. The CVSS score of 6.8 indicates a moderate severity; an attacker would need network connectivity to the service and no special credentials, so the attack vector is likely remote over HTTP or HTTPS.

The vulnerability affects Spring Cloud Config versions 5.0.0 through 5.0.4, 4.3.0 through 4.3.4, 4.0.0 through 4.2.8, and all releases up to and including 3.1.14. These versions are maintained by the Spring team and widely used for configuration management in distributed applications.

The lack of authentication greatly increases exploitation risk when the /monitor endpoint is publicly reachable. While the EPSS score is not available, the moderate CVSS score and absence of a KEV listing suggest the vulnerability is not widely exploited yet; however, any deployment without additional network controls is still at significant risk. The flaw can be abused by sending crafted webhook calls to the endpoint to read monitoring data or inject monitoring commands, especially if no encryption or IP filtering is applied.