CVE-2026-47836: Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-26 · updated 2026-09-04
Weakness: CWE-367

Description

The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

Affected products

Spring Cloud Config: before 3.1.15; from 4.0.0 before 4.2.9; from 4.3.0 before 4.3.5; from 5.0.0 before 5.0.5 — fixed in 3.1.15, 4.2.9, 4.3.5, 5.0.5
Spring Cloud Config: from 5.0.0 through 5.0.4; from 4.3.0 through 4.3.4; from 4.0.0 through 4.2.8; through 3.1.14

How to fix

Upgrade to a fixed version: Spring Cloud Config 3.1.15, 4.2.9, 4.3.5, 5.0.5. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-47836

Get alerted when CVE-2026-47836 or the next vulnerability affects your stack