Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreCVE-2026-41002: Spring Cloud Config Server Susceptible To TOCTOU Attack
Description
The base directory (spring.cloud.config.server.git.basedir) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks.
Affected Spring Products and Versions
Spring Cloud Config:
- 3.1.x
- 4.1.x
- 4.2.x
- 4.3.x
- 5.0.x
- Older, unsupported versions are also affected
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 3.1.x | 3.1.14 | Enterprise Support Only |
| 4.1.x | 4.1.10 | Enterprise Support Only |
| 4.2.x | 4.2.7 | Enterprise Support Only |
| 4.3.x | 4.3.3 | OSS |
| 5.0.x | 5.0.3 | OSS |
Credit
The issue was identified and responsibly reported by Yu Bao who works for PayPal.com (@August829).
References
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all