CVE Explorer

CVE-2026-41002

The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:80890ad4e4fc2a83a98b3cd61ec805056a0952c3b5298f0d69a7a4f95b2341f0

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Spring Cloud Config","vendor":"Spring","versions":[{"lessThan":"3.1.14","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"4.1.10","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.7","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.3","status":"affected","version":"4.3.0","versionType":"custom"},{"lessThan":"5.0.3","status":"affected","version":"5.0.0","versionType":"custom"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:8c0daf8f1cbe266818421dcf7d60179841b6e31cf34c1243fdfbb6de23dacde9 · sha256:d5d85ce0f3972074… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:8c0daf8f1cbe266818421dcf7d60179841b6e31cf34c1243fdfbb6de23dacde9 · sha256:d5d85ce0f3972074… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-367","description":"CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:8c0daf8f1cbe266818421dcf7d60179841b6e31cf34c1243fdfbb6de23dacde9 · sha256:d5d85ce0f3972074… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"url":"https://spring.io/security/cve-2026-41002"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8c0daf8f1cbe266818421dcf7d60179841b6e31cf34c1243fdfbb6de23dacde9 · sha256:d5d85ce0f3972074… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer