GHSA-86wq-234q-r6wg

Source

https://github.com/advisories/GHSA-86wq-234q-r6wg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-86wq-234q-r6wg/GHSA-86wq-234q-r6wg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-86wq-234q-r6wg

Aliases

CVE-2026-41002

Published

2026-05-07T06:31:41Z

Modified

2026-06-18T23:00:09Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Spring Cloud Config Server Susceptible To TOCTOU Attack

Details

The base directory (spring.cloud.config.server.git.basedir) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks.

Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 (inclusive); no open-source upgrade available.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); no open-source upgrade available.
Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); no open-source upgrade available.
Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); no open-source upgrade available.
Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater.
Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

Database specific

{
    "cwe_ids":  [
        "CWE-367"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-11T16:19:26Z",
    "nvd_published_at":  "2026-05-07T04:16:25Z",
    "severity":  "HIGH"
}

References

Affected packages

Maven

org.springframework.cloud:spring-cloud-config-server

Package

Name: org.springframework.cloud:spring-cloud-config-server; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.cloud/spring-cloud-config-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.1.0

Last Affected

3.1.13

Affected versions

3.*

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

3.1.9

3.1.10

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-86wq-234q-r6wg/GHSA-86wq-234q-r6wg.json"

org.springframework.cloud:spring-cloud-config-server

Package

Name: org.springframework.cloud:spring-cloud-config-server; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.cloud/spring-cloud-config-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.1.0

Last Affected

4.1.9

Affected versions

4.*

4.1.0

4.1.1

4.1.2

4.1.3

4.1.4

4.1.5

4.1.6

4.1.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-86wq-234q-r6wg/GHSA-86wq-234q-r6wg.json"

org.springframework.cloud:spring-cloud-config-server

Package

Name: org.springframework.cloud:spring-cloud-config-server; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.cloud/spring-cloud-config-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.2.0

Last Affected

4.2.6

Affected versions

4.*

4.2.0

4.2.1

4.2.2

4.2.3

4.2.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-86wq-234q-r6wg/GHSA-86wq-234q-r6wg.json"

org.springframework.cloud:spring-cloud-config-server

Package

Name: org.springframework.cloud:spring-cloud-config-server; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.cloud/spring-cloud-config-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.3.0

Fixed

4.3.3

Affected versions

4.*

4.3.0

4.3.1

4.3.2

Database specific

last_known_affected_version_range

"<= 4.3.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-86wq-234q-r6wg/GHSA-86wq-234q-r6wg.json"

org.springframework.cloud:spring-cloud-config-server

Package

Name: org.springframework.cloud:spring-cloud-config-server; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.cloud/spring-cloud-config-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.0.3

Affected versions

5.*

5.0.0

5.0.1

5.0.2

Database specific

last_known_affected_version_range

"<= 5.0.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-86wq-234q-r6wg/GHSA-86wq-234q-r6wg.json"

org.springframework.cloud:spring-cloud-config-server

Package

Name: org.springframework.cloud:spring-cloud-config-server; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.cloud/spring-cloud-config-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Last Affected

3.0.7

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-86wq-234q-r6wg/GHSA-86wq-234q-r6wg.json"