CVE-2026-47836: Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Cloud Config Serverto a version that resolves this vulnerability.Fixed in 3.1.14 and earlier - Upgrade
Upgrade
Spring Cloud Config Serverto a version that resolves this vulnerability.Fixed in 4.0.0 - 4.2.8 - Upgrade
Upgrade
Spring Cloud Config Serverto a version that resolves this vulnerability.Fixed in 4.3.0 - 4.3.4 - Upgrade
Upgrade
Spring Cloud Config Serverto a version that resolves this vulnerability.Fixed in 5.0.0 - 5.0.4 - Configuration
Harden or adjust the SVN base directory (spring.cloud.config.server.svn.basedir), which is susceptible to TOCTOU attacks when the Spring Cloud Config Server clones SVN repositories.
Spring Cloud Config Server spring.cloud.config.server.svn.basedir = not specified
Event History
Frequently Asked Questions
Which deployments are affected?
Spring Cloud Config Server deployments using SVN repositories are affected when they use the configured base directory for SVN clones. The affected release ranges are 5.0.0 through 5.0.4, 4.3.0 through 4.3.4, 4.0.0 through 4.2.8, and 3.1.14 and earlier.
What level of access does an attacker need?
The supplied vector indicates exploitation requires local access, high privileges, and high attack complexity. No user interaction is required.
What impact can successful exploitation have?
Successful exploitation can result in high confidentiality and integrity impact, including across a changed security scope. The supplied vector does not indicate an availability impact.