CVE-2026-41001: Predictable Temp Directory in Artemis Auto-configuration
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Boot ArtemisEmbeddedConfigurationFactory / embedded Artemis message broker predictable temp directoryto a version that resolves this vulnerability.Fixed in 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33 - Configuration
Configure Spring Boot to use an explicit embedded Artemis message broker data directory path (so ArtemisEmbeddedConfigurationFactory does not use the fixed static path for the embedded broker’s data directory).
Spring Boot (ArtemisEmbeddedConfigurationFactory) / embedded Artemis message broker embedded Artemis message broker data directory path (explicit path vs default static fixed path) = Set an explicit data directory path instead of relying on the fixed, static default when no explicit path is configured
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41001?
The severity of CVE-2026-41001 is medium with a score of 5.3.
How do I fix CVE-2026-41001?
To fix CVE-2026-41001, ensure you configure a unique, explicit path for the Artemis message broker's data directory.
Who is affected by CVE-2026-41001?
CVE-2026-41001 affects applications using Spring Boot with the ArtemisEmbeddedConfigurationFactory without an explicitly configured data directory path.
What type of attack is possible due to CVE-2026-41001?
A local attacker can exploit CVE-2026-41001 by creating a predictable directory or placing a symlink to manipulate the embedded Artemis message broker's data.
When was CVE-2026-41001 published?
CVE-2026-41001 was published on June 11, 2026.