High

Spring Cloud Config Server Susceptible To TOCTOU Attack

Disclosed: 07.05.2026
Updated: 11.10.2026 12:22

The base directory (spring.cloud.config.server.git.basedir) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks.

Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 (inclusive); no open-source upgrade available.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); no open-source upgrade available.
Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); no open-source upgrade available.
Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); no open-source upgrade available.
Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater.
Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	org.springframework.cloud:spring-cloud-config-server	>= 3.1.0, <= 3.1.13, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.6, >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.3, >= 3.0.0, <= 3.0.7	4.3.3, 5.0.3

References

CVSS score 7.2/10

CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Weakness (CWE): CWE-367
Platform: Java / Kotlin (Maven)
Package: org.springframework.cloud:spring-cloud-config-server
Disclosed: 07.05.2026
Updated: 11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-86wq-234q-r6wg - CC BY 4.0

Vulnerability history: org.springframework.cloud:spring-cloud-config-server

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 8
First → latest: 05.2019 05.2026
Without a fix: 0
Exploited in attacks: 1

Severity breakdown

Critical 1
High 4
Medium 3

Disclosures per year

2019: 1
2020: 2
2021: 0
2022: 0
2023: 0
2024: 0
2025: 0
2026: 5

07.05.2026

Spring Cloud Config Server Logged Sensitive Information

Medium · 4.4 CVE-2026-41004 >= 3.1.0, <= 3.1.13, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.6, >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.3, >= 3.0.0, <= 3.0.7 4.3.3, 5.0.3
07.05.2026

Spring Cloud Config Server Susceptible To TOCTOU Attack this entry

High · 7.2 CVE-2026-41002 >= 3.1.0, <= 3.1.13, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.6, >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.3, >= 3.0.0, <= 3.0.7 4.3.3, 5.0.3
07.05.2026

Spring Cloud Config vulnerable to Path Traversal

Critical · 9.1 CVE-2026-40982 <= 3.1.13, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.6, >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.3 4.3.3, 5.0.3
07.05.2026

Spring Cloud Config has an Authorization Bypass Through User-Controlled Key

High · 7.5 CVE-2026-40981 >= 3.1.0, <= 3.1.13, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.6, >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.3 4.3.3, 5.0.3
24.03.2026

Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access

High · 8.6 CVE-2026-22739 >= 4.3.0, < 4.3.2, >= 5.0.0-M1, < 5.0.2, >= 4.2.0, <= 4.2.4, >= 4.0.0, <= 4.1.7, <= 3.1.10 4.3.2, 5.0.2
05.06.2020

Directory traversal attack in Spring Cloud Config

High · 7.5 Exploited in attacks CVE-2020-5410 >= 2.1.0, < 2.1.9, >= 2.2.0, < 2.2.3 2.1.9, 2.2.3
05.06.2020

Directory traversal attack in Spring Cloud Config

Medium · 6.5 CVE-2020-5405 >= 2.1.0, < 2.1.7, >= 2.2.0, < 2.2.2 2.1.7, 2.2.2
23.05.2019

Path Traversal in Spring Cloud Config

Medium · 6.5 CVE-2019-3799 < 1.4.6, >= 2.0.0, < 2.0.4, >= 2.1.0, < 2.1.2 1.4.6, 2.0.4, 2.1.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application