PT-2026-38331 · Vmware · Spring Cloud Config

August829 + 1 · Published 2026-05-07 · Updated 2026-05-07 · CVE-2026-41002

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring Cloud Config versions 3.1.0 through 3.1.13 Spring Cloud Config versions 4.1.0 through 4.1.9 Spring Cloud Config versions 4.2.0 through 4.2.6 Spring Cloud Config versions 4.3.0 through 4.3.2 Spring Cloud Config versions 5.0.0 through 5.0.2

Description The base directory spring.cloud.config.server.git.basedir used by the Spring Cloud Config Server to clone Git repositories is susceptible to time-of-check-time-of-use (TOCTOU) attacks. TOCTOU is a race condition where a system checks the state of a resource and then performs an action based on that state, but the resource is modified between the check and the action.

Recommendations Upgrade versions 3.1.0 through 3.1.13 to 3.1.14 or greater. Upgrade versions 4.1.0 through 4.1.9 to 4.1.10 or greater. Upgrade versions 4.2.0 through 4.2.6 to 4.2.7 or greater. Upgrade versions 4.3.0 through 4.3.2 to 4.3.3 or greater. Upgrade versions 5.0.0 through 5.0.2 to 5.0.3 or greater.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-41002

GHSA-86WQ-234Q-R6WG

Affected Products

Spring Cloud Config

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-41002 · Security Note
• https://spring.io/security/cve-2026-41002 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-86wq-234q-r6wg · Vendor Advisory
• https://github.com/spring-cloud/spring-cloud-config · Note
• https://t.me/cveNotify/162484 · Telegram Post
• https://twitter.com/CVEnew/status/2052400820998836495 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052340713891746013 · Twitter Post
• https://twitter.com/CVEarity/status/2052362621312258498 · Twitter Post