CVE-2026-41002 Spring Cloud Config Server Susceptible To TOCTOU Attack
Attackers can exploit a race condition in the Git repository cloning process to potentially execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41002?
CVE-2026-41002 is a high-severity vulnerability in Spring Cloud Config, published on 7 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Weakness: CWE-367
Which versions are affected by CVE-2026-41002?
12 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-config-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.cloud:spring-cloud-config-server Maven | From 3.0.0 to 3.0.7 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 3.0.0 to 3.0.7 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 3.1.0 to 3.1.13 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 3.1.0 to 3.1.13 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.1.0 to 4.1.9 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.1.0 to 4.1.9 | None |
6 more packages
org.springframework.cloud:spring-cloud-config-server Maven | From 4.2.0 to 4.2.6 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.2.0 to 4.2.6 | None |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.3.0 | 4.3.3 |
org.springframework.cloud:spring-cloud-config-server Maven | From 4.3.0 | 4.3.3 |
org.springframework.cloud:spring-cloud-config-server Maven | From 5.0.0 | 5.0.3 |
org.springframework.cloud:spring-cloud-config-server Maven | From 5.0.0 | 5.0.3 |
Products include Vmware Spring Cloud Config.
How do I fix CVE-2026-41002?
Upgrade org.springframework.cloud:spring-cloud-config-server to a fixed version for your release line: 4.3.3 or 5.0.3.
Is CVE-2026-41002 being exploited?
There is no known exploitation of CVE-2026-41002 in the wild and no public exploit code.
Other vulnerabilities in Spring Cloud Config
- CVE-2020-5410 VMware Tanzu Spring Cloud Config Directory Traversal
- CVE-2026-40982 Spring Cloud Config vulnerable to Path Traversal
- CVE-2026-22739 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
- CVE-2026-40981 Spring Cloud Config has an Authorization Bypass Through User-Controlled Key
- CVE-2026-47836 Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
Sources
Also known as GHSA-86wq-234q-r6wg, ROOT-APP-MAVEN-CVE-2026-41002.