CVE-2026-41002

HighCVSS 7.2

Published: 07/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

The Spring Cloud Config Server is susceptible to time-of-check-time-of-use (TOCTOU) attacks due to the use of a base directory for cloning Git repositories.

Risk Assessment

An attacker could exploit this vulnerability to manipulate data at the time it is checked and used, potentially leading to unauthorized access to application configurations.

Recommendation

It is recommended to upgrade to version 3.1.14 or higher for 3.1.x, 4.1.10 or higher for 4.1.x, 4.2.7 or higher for 4.2.x, 4.3.3 or higher for 4.3.x, and 5.0.3 or higher for 5.0.x.

Other vulnerabilities in Spring Cloud Config Server

CVE-2026-41004Medium
When trace logging was enabled in Spring Cloud Config Server, sensitive information was written to logs in plain text. The issue affects 3.1.x, 4.1.x, 4.2.x, 4.3.x and 5.0.x branches within specific version ranges.

Original NVD description (English source)

The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS