CVE-2026-41001: Predictable Temp Directory in Artemis Auto-configuration
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure an explicit data directory for the embedded Artemis broker (do not rely on the default fixed/static path used when no path is configured). Set the data directory path in your Spring Boot configuration (e.g., application.properties or application.yml) to a dedicated, non-predictable location before application start to prevent pre-creation or symlink attacks.
Spring Boot (ArtemisEmbeddedConfigurationFactory / embedded Artemis broker) embedded Artemis data directory path = explicit, non-predictable path
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41001?
The severity of CVE-2026-41001 is medium with a score of 5.3.
How do I fix CVE-2026-41001?
To fix CVE-2026-41001, ensure you configure a unique, explicit path for the Artemis message broker's data directory.
Who is affected by CVE-2026-41001?
CVE-2026-41001 affects applications using Spring Boot with the ArtemisEmbeddedConfigurationFactory without an explicitly configured data directory path.
What type of attack is possible due to CVE-2026-41001?
A local attacker can exploit CVE-2026-41001 by creating a predictable directory or placing a symlink to manipulate the embedded Artemis message broker's data.
When was CVE-2026-41001 published?
CVE-2026-41001 was published on June 11, 2026.