CVE-2026-47836 — Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

CVE-2026-47836

Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN PUBLISHED

Description (CNA)

The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

Affected (CNA)

Vendor / product	Versions
Spring / Spring Cloud Config	affected 5.0.0 through 5.0.4; affected 4.3.0 through 4.3.4; affected 4.0.0 through 4.2.8; affected 0 through 3.1.14

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-47836

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.