CVE-2026-47836 Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
Attackers can exploit a race condition in SVN repository cloning to execute arbitrary code or escalate privileges on Spring Cloud Config Server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47836?
CVE-2026-47836 is a high-severity vulnerability in Spring Cloud Config, published on 26 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier
Weakness: CWE-367
Which versions are affected by CVE-2026-47836?
It affects 1 product.
Products include Vmware Spring Cloud Config.
How do I fix CVE-2026-47836?
Upgrade to a fixed version.
Is CVE-2026-47836 being exploited?
There is no known exploitation of CVE-2026-47836 in the wild and no public exploit code.
Other vulnerabilities in Spring Cloud Config
- CVE-2020-5410 VMware Tanzu Spring Cloud Config Directory Traversal
- CVE-2026-40982 Spring Cloud Config vulnerable to Path Traversal
- CVE-2026-22739 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
- CVE-2026-40981 Spring Cloud Config has an Authorization Bypass Through User-Controlled Key
- CVE-2026-41002 Spring Cloud Config Server Susceptible To TOCTOU Attack
Sources
Also known as GHSA-w2ff-ccff-p3cx.