Vulnerability · Published May 7, 2026 · Assigned by vmware
CVE-2026-41002
High 7.4
In plain English
A high-severity security flaw in Spring Cloud Config from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-86wq-234q-r6wg |
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-86wq-234q-r6wg |
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-86wq-234q-r6wg |
| Maven | org.springframework.cloud:spring-cloud-config-server | 4.3.3 | GHSA-86wq-234q-r6wg |
| Maven | org.springframework.cloud:spring-cloud-config-server | 5.0.3 | GHSA-86wq-234q-r6wg |
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-86wq-234q-r6wg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Cloud Config | 3.1.0 – before 3.1.144.1.0 – before 4.1.104.2.0 – before 4.2.74.3.0 – before 4.3.35.0.0 – before 5.0.3 |
Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N