CVE-2026-41001
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Vulnerability in Spring Boot where ArtemisEmbeddedConfigurationFactory uses a fixed, predictable path for the Artemis broker data directory. A local attacker can create a symlink before application start.
Risk Assessment
An attacker can take control of Artemis broker data, potentially leading to integrity and confidentiality breaches.
Recommendation
Update Spring Boot to version 4.0.7, 3.5.15, 3.4.17, 3.3.20, or 2.7.34 (depending on your line).
Other vulnerabilities in Spring Boot
See all- CVE-2026-40976Critical
Spring Boot versions 4.0.0–4.0.5 have ineffective default web security, allowing unauthorized access to all endpoints. The vulnerability affects servlet-based applications without custom Spring Security configuration, using spring-boot-actuator-autoconfigure and not depending on spring-boot-health.
- CVE-2026-40992Medium
In Spring Boot, a vulnerability was found in the mail auto-configuration that does not enable hostname verification. Applications that explicitly set the JavaMail property (e.g., spring.mail.properties.mail.smtp.ssl.checkserveridentity=true) are not affected. Affected versions are Spring Boot 4.0.0-4.0.6, 3.5.0-3.5.14, and 3.4.0-3.4.16.
- CVE-2026-40977Medium
In Spring Boot, when an application uses ApplicationPidFileWriter, a local attacker with write access to the PID file location can corrupt one file on the host each time the application starts. Affects versions 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, 2.7.0-2.7.32.
- CVE-2026-40975Medium
In Spring Boot, values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected, but ${random.int} and ${random.long} have a predictable range. Affected versions: 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, 2.7.0–2.7.32.
- CVE-2026-40974Medium
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. This affects multiple Spring Boot versions including 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, and 2.7.0–2.7.32.
- CVE-2026-40973High
Spring Boot versions 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, 2.7.0-2.7.32 have a vulnerability due to a predictable temp directory (ApplicationTemp). A local attacker can take control of this directory, and with persistent sessions enabled, can read sessions, hijack users, or execute code.
- CVE-2026-40972High
An attacker on the same network as the remote application may use a timing attack to leak information about the remote secret. In extreme cases, this could allow the attacker to determine the secret and upload modified classes, achieving remote code execution.
- CVE-2026-40971Medium
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected versions: Spring Boot 4.0.0–4.0.5 (fixed in 4.0.6), 3.5.0–3.5.13 (fixed in 3.5.14).
Original NVD description (English source)
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.