CVE-2026-41002: Spring Cloud Config Server Vulnerable to TOCTOU Attack
Summary
CVE-2026-41002: Spring Cloud Config Server Susceptible To TOCTOU Attack. Affects org.springframework.cloud:spring-cloud-config-server across 5 version ranges.
>= 3.1.0, <= 3.1.13
>= 4.1.0, <= 4.1.9
>= 4.2.0, <= 4.2.6
>= 4.3.0, < 4.3.3
>= 5.0.0, < 5.0.3
Fixed in 4.3.3 or 5.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Cloud Config Server is a critical component of the Spring Cloud ecosystem, providing server-side support for externalized configuration in a distributed system. It allows applications to retrieve configuration properties from a centralized location, typically using Git repositories. The server's functionality is essential for managing application settings across various environments, ensuring consistency and ease of updates. However, it has been identified as vulnerable to a time-of-check-time-of-use (TOCTOU) attack, which can compromise the integrity of the configuration data.
Vulnerability Detail
The vulnerability arises from the base directory used by the Spring Cloud Config Server to clone Git repositories. This directory is susceptible to TOCTOU attacks, where an attacker can manipulate the state of the directory between the time it is checked for validity and the time it is used. This can lead to unauthorized access to sensitive configuration data or the injection of malicious configurations. The affected versions span multiple releases, including 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x, with a CVSS score of 7.2 indicating a high severity level.
How To Fix
Latest published version: 5.1.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.3.0, < 4.3.34.3.3 -
>= 5.0.0, < 5.0.35.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the base directory for the Spring Cloud Config Server is secured and monitored for unauthorized changes. Implementing strict access controls and regular audits can help mitigate the risk until the package is updated.
Conclusion
The Spring Cloud Config Server vulnerability (CVE-2026-41002) poses a significant risk due to its susceptibility to TOCTOU attacks. It is crucial for users of affected versions to upgrade to the latest patched versions to mitigate this risk. Additionally, implementing temporary workarounds can help secure the system until an upgrade is feasible.
See every vulnerability recorded for org.springframework.cloud:spring-cloud-config-server →
FAQ
A TOCTOU (Time-of-Check to Time-of-Use) attack is a type of race condition where an attacker exploits the time gap between checking a condition and using the result of that check, potentially leading to unauthorized actions.
The affected versions include 3.1.0 to 3.1.13, 4.1.0 to 4.1.9, 4.2.0 to 4.2.6, 4.3.0 to 4.3.2, and 5.0.0 to 5.0.2.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If immediate upgrading is not possible, implement strict access controls and monitor the base directory for unauthorized changes as a temporary workaround.
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.cloud:spring-cloud-config-server.
