7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41002

CVE-2026-41002: Spring Cloud Config Server Susceptible To TOCTOU Attack

The base directory (spring.cloud.config.server.git.basedir) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41002

CVE-2026-41002:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.springframework.cloud:spring-cloud-config-server	maven	>= 3.1.0, <= 3.1.13
org.springframework.cloud:spring-cloud-config-server	maven	>= 4.1.0, <= 4.1.9
org.springframework.cloud:spring-cloud-config-server	maven	>= 4.2.0, <= 4.2.6
org.springframework.cloud:spring-cloud-config-server	maven	>= 4.3.0, <= 4.3.2	4.3.3
org.springframework.cloud:spring-cloud-config-server	maven	>= 5.0.0, <= 5.0.2	5.0.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition in the Spring Cloud Config Server's Git backend. The JGitEnvironmentRepository class, responsible for managing Git repositories, performed file system operations on a configurable base directory (spring.cloud.config.server.git.basedir) in an insecure manner. The analysis of the patch that fixes this vulnerability reveals that several methods were involved in the vulnerable workflow.

The core of the issue lies in the sequence of operations: checking for the existence of the base directory, deleting its contents, creating it, and then cloning a Git repository into it. An attacker with local access to the server could exploit the time window between these operations to replace the base directory with a symbolic link pointing to a different location on the file system. This could lead to either arbitrary file deletion (if the symlink is placed before the deletion step) or arbitrary file creation/overwrite (if the symlink is placed before the cloning step).

The patch addresses this by introducing more robust file system handling. It avoids following symbolic links when deleting files, and it uses atomic or near-atomic operations to create the base directory, significantly reducing the window for a TOCTOU attack. The identified vulnerable functions are the ones from the pre-patch code that were responsible for these insecure file system operations.

Vulnerable functions

org.springframework.cloud.config.server.environment.JGitEnvironmentRepository.deleteBaseDirIfExists

spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/environment/JGitEnvironmentRepository.java

The original `deleteBaseDirIfExists` function recursively deleted files in the base directory. If an attacker replaced the base directory with a symbolic link to another location on the file system between the check and the delete operation (TOCTOU), this function could be used to delete arbitrary files. The `FileUtils.delete` method with `RECURSIVE` option would follow these symbolic links.

org.springframework.cloud.config.server.environment.JGitEnvironmentRepository.initClonedRepository

spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/environment/JGitEnvironmentRepository.java

This function was responsible for initializing a cloned repository. It called the vulnerable `deleteBaseDirIfExists()` and then `cloneToBasedir()`. This sequence of operations was susceptible to a TOCTOU attack where the base directory could be replaced by a symbolic link after deletion and before cloning, leading to cloning into an arbitrary location.

org.springframework.cloud.config.server.environment.JGitEnvironmentRepository.copyRepository

spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/environment/JGitEnvironmentRepository.java

This function, which is synchronized to prevent race conditions between threads, was still vulnerable to a TOCTOU attack from an external process. It called `deleteBaseDirIfExists()`, then created the directory, and finally called `cloneToBasedir()`. An attacker could replace the directory with a symbolic link between these steps.

org.springframework.cloud.config.server.environment.JGitEnvironmentRepository.cloneToBasedir

spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/environment/JGitEnvironmentRepository.java

The `cloneToBasedir` function performed the git clone operation into the `basedir`. This function was vulnerable because it operated on a directory path that could have been replaced by a symbolic link due to a TOCTOU race condition in the calling functions (`initClonedRepository` and `copyRepository`). This would cause the git repository to be cloned into an attacker-controlled location.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.