CVE-2025-22232

A flaw was found in Spring Cloud Config Server. This vulnerability allows an attacker to bypass Vault token validation via the X-CONFIG-TOKEN header. If a malicious client sends a different Vault token in the X-CONFIG-TOKEN header, the Spring Cloud Config Server may continue using the first token it retrieved, instead of the one sent by the client. This can result in unauthorized access to sensitive data from Vault.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.