CVE-2026-47836

Name of the Vulnerable Software and Affected Versions Spring Cloud Config versions 5.0.0 through 5.0.4 Spring Cloud Config versions 4.3.0 through 4.3.4 Spring Cloud Config versions 4.0.0 through 4.2.8 Spring Cloud Config versions 3.1.14 and earlier

Description The base directory used by the Spring Cloud Config Server to clone SVN repositories is susceptible to time-of-check-time-of-use (TOCTOU) attacks. This issue involves the spring.cloud.config.server.svn.basedir variable. TOCTOU is a race condition where a system checks the state of a resource before using it, but the state changes between the check and the use.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.