EUVD-2026-66637
GHSA-w2ff-ccff-p3cx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend rapid SVN-refresh requests to Config Server
-
DeliveryWin filesystem race between path check and use
-
ExploitSwap basedir with symlink to sensitive target
-
ExecutionConfig Server reads/writes attacker-chosen filesystem path
-
PersistExfiltrate secrets or overwrite critical files
-
ImpactFull process-level compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Exploitation Conditions | Exploitation requires two simultaneous conditions: the Spring Cloud Config Server must be configured to use the SVN backend (spring.cloud.config.server.svn.* properties active) - deployments using only Git or Vault backends are not affected. Additionally, an attacker must be able to both (1) send network requests to the Config Server to trigger SVN clone/refresh operations and (2) manipulate the local basedir filesystem path (e.g., via a symlink) during the race window - this typically implies some level of local filesystem access on the server host or an attacker-controlled SVN endpoint that can influence the clone path. Authentication is not required to reach the Config Server in default deployments (PR:N in vendor CVSS), but winning the race (AC:H) requires precise timing. Limiting factors include: race-condition timing difficulty (SSVC Automatable:No), requirement for SVN backend configuration (non-default in many deployments), and the need for concurrent filesystem manipulation capability. |
| Impact | The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly reflects that while the Config Server is network-reachable and no authentication is required to trigger SVN operations in typical deployments, the High Complexity rating captures the inherent timing difficulty of winning a TOCTOU race - even a mid-sized municipal IT team in gdynia should treat this as a controlled but non-urgent patching priority, given the operational complexity required to exploit it. SSVC assigns Automatable:No, consistent with race-condition attack difficulty, but Technical Impact:Total underscores worst-case post-exploitation consequences. EPSS at 0.08% (0th percentile) signals negligible current exploitation probability, and no active exploitation is listed in CISA KEV. No public exploit code has been identified. The realistic risk priority is moderate for organizations running SVN-backed Config Server instances exposed to semi-trusted networks; patch availability from VMware/Spring makes remediation straightforward and preferable to any compensating control. |
| Exploit ScenarioDerived | An attacker with network access to an unauthenticated Spring Cloud Config Server endpoint sends a sequence of rapid requests that trigger SVN repository clone or refresh operations. Concurrently - via a separate process with local filesystem access, or by controlling the SVN server to deliver a malicious repository - the attacker replaces the basedir with a symlink to a sensitive filesystem path (e.g., /etc/ssl/private or application secret directories). If the race is won, the Config Server reads from or writes to the symlinked target, yielding arbitrary file read or write as the Config Server process account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 04, 2026
Time-of-check-time-of-use (TOCTOU) race condition in Spring Cloud Config Server's SVN backend allows unauthenticated network attackers to manipulate the basedir path between validation and use, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Affected are all branches of Spring Cloud Config through 5.0.4, 4.3.4, 4.2.8, and 3.1.14 and earlier, covering a broad range of enterprise Spring microservices deployments. No public exploit code has been identified and no active exploitation is confirmed; however, the vendor (VMware/Spring) has released patches across all affected branches.
Earlier versions of this analysis (1)
Spring Cloud Config Server's SVN backend is vulnerable to time-of-check-time-of-use (TOCTOU) race conditions on the local base directory (spring.cloud.config.server.svn.basedir) used to clone SVN repositories. An attacker with local high-privilege access can manipulate the directory - for example, by substituting a symlink - between the check and use phases, potentially gaining unauthorized read or write access to configuration data served to downstream microservices. The CVSS scope-change metric (S:C) indicates that successful exploitation can cascade beyond the Config Server itself, affecting applications that consume the tampered configuration. No public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Upgrade to the patched releases as soon as operationally feasible: Spring Cloud Config 5.0.5 or later (5.0 branch), 4.3.5 or later (4.3 branch), 4.2.9 or later (4.0-4.2 branch), or 3.1.15 or later (3.1 branch). Exact fix versions are not independently confirmed in the available references beyond the vendor advisory at https://spring.io/security/cve-2026-47836 - consult that page for the canonical fixed release numbers. If immediate patching is not possible, restrict network access to the Config Server's port to known trusted clients (e.g., firewall rules, mutual TLS, or an API gateway) to reduce the attacker's ability to trigger SVN clone operations on demand, thereby narrowing the race window. Avoid storing the SVN basedir on a path accessible to other processes or network shares, as this widens the attack surface for symlink manipulation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Spring Cloud Config Server supports SVN as an externalized configuration backend, controlled by the spring.cloud.config.server.svn.basedir property, which designates the local directory into which SVN repositories are cloned. CWE-367 (TOCTOU Race Condition) describes a class of bugs where a security-relevant check (e.g., validating the basedir path, confirming it is a trusted directory) is performed at one point in time, but the actual use of that path occurs later - leaving a window during which an attacker can swap the directory or insert a symlink to an arbitrary filesystem location. The affected CPE is cpe:2.3:a:spring:spring_cloud_config (all versions through the patched releases). Because the race window can be triggered by an incoming Config Server request (e.g., a config fetch that triggers a fresh SVN clone or refresh), network reachability to the Config Server endpoint is sufficient to initiate exploitation attempts.
Know when Spring gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-triggered SVN refresh allows unauthenticated initiation; AC:H reflects race-condition timing required; full C/I/A if race is won.
Primary rating from Vendor (vmware).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier
Articles & Coverage 1
Executive ViewAI
Spring Cloud Config Server (versions 5.0.4 and earlier) contains an unauthenticated vulnerability allowing attackers to manipulate configuration data paths, potentially exposing or modifying sensitive application credentials and infrastructure settings across enterprise microservices deployments. Organizations managing centralized configuration through Spring Cloud Config face risk of complete compromise of system confidentiality, integrity, and availability without immediate remediation. Vendor patches are available for all affected versions.
Apply vendor patch: upgrade Spring Cloud Config Server to version 5.0.5 or later (4.3.5+, 4.2.9+, 3.1.15+ for respective branches). If patching requires delay, restrict network access to Config Server instances via firewall rules and disable the SVN backend if not actively required for configuration sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. Rated critical severi
Access control bypass in SpringBlade v4.5.0 importUser function allows low-privileged users to import sensitive user dat
Spring Cloud Config Server contains a path traversal vulnerability when using the native file system backend, allowing u
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant
SpringBlade v4.5.0 has an access control flaw in authRoutes allowing low-privileged users to escalate to admin through t
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated at
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across
Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Sprin
Unsafe JSON deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJso
Spring Security Aspects may not correctly locate method security annotations on private methods. Rated critical severity
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input esca
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files
Exploit-DB