Introduction
A race condition in how Spring Cloud Config Server clones Git repositories lets a locally privileged attacker manipulate the filesystem directory used for configuration storage. That could expose or tamper with sensitive configuration data distributed to downstream microservices. The vulnerability, tracked as CVE-2026-41002, has a CVSS score of 7.2 (High) and affects five active release trains. The remediation path depends on whether an organization holds VMware Enterprise Support.
Spring Cloud Config Server is the central configuration management component in the Spring Cloud ecosystem, widely used to externalize and distribute configuration across microservices deployments. It reads from Git repositories and serves versioned configuration properties to client applications at runtime.
Technical Information
CVE-2026-41002 is classified under CWE-367: Time of Check Time of Use (TOCTOU) Race Condition. The vulnerability is in the handling of the spring.cloud.config.server.git.basedir configuration property. This property sets the local filesystem directory where Spring Cloud Config Server clones the Git repositories that contain application configuration.
The server checks the state of this base directory and then uses it in a later, non-atomic operation. The gap between the check and the use leaves a window in which an attacker can change the directory on the filesystem. By substituting the directory between the check and the use (for example, with a symlink swap or directory replacement), an attacker could redirect the Config Server to an attacker-controlled location.
CVSS Vector Analysis
The full CVSS v3.1 vector is AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N. Its components say a lot about both the constraints on exploitation and the impact:
- Attack Vector (Local): The attacker must have local access to the system running the Config Server. The vulnerability is not remotely exploitable.
- Attack Complexity (High): Exploiting the race condition requires precise timing to manipulate the directory during the narrow window between the check and the use.
- Privileges Required (High): The attacker needs elevated privileges on the local system, which sharply narrows the pool of potential attackers.
- User Interaction (None): No action from a legitimate user is needed to trigger the vulnerability.
- Scope (Changed): This is the most notable part of the score. A scope change means the impact reaches beyond the vulnerable component (the Config Server process) to other components, likely the downstream services that consume configuration from the server.
- Confidentiality and Integrity (High/High): A successful exploit could expose sensitive configuration values (database credentials, API keys, secrets) and let an attacker inject or modify the configuration data served to client applications.
- Availability (None): The vulnerability does not affect system availability.
The scope change matters most in microservices architectures. If an attacker can manipulate the configuration source, every downstream service that pulls configuration from the compromised Config Server instance could be affected. That makes the vulnerability especially relevant in multi-tenant environments or shared infrastructure, where multiple users or processes have local access to the Config Server host.
What We Do Not Know
The available sources do not include proof-of-concept exploit code, details of the vulnerable code path, or a step-by-step exploitation walkthrough. We cannot confirm the exact mechanism (symlink attack, directory replacement, mount manipulation, or another technique) an attacker would use to exploit the race window.
Affected Systems and Versions
The vulnerability spans five active release trains of Spring Cloud Config:
| Affected Version Range | Fixed Version | Availability |
|---|---|---|
| 3.1.0 through 3.1.13 | 3.1.14 | Enterprise Support Only |
| 4.1.0 through 4.1.9 | 4.1.10 | Enterprise Support Only |
| 4.2.0 through 4.2.6 | 4.2.7 | Enterprise Support Only |
| 4.3.0 through 4.3.2 | 4.3.3 | Open Source |
| 5.0.0 through 5.0.2 | 5.0.3 | Open Source |
Older, unsupported versions are also affected. Organizations on the 3.1.x, 4.1.x, or 4.2.x branches without an active Enterprise Support agreement must migrate to the 4.3.x or 5.0.x branch to get the fix through the open source channel.
Consider any deployment at risk if it uses the spring.cloud.config.server.git.basedir property (or relies on the default base directory behavior) on a system where multiple users or processes have local access.
Vendor Security History
CVE-2026-41002 was disclosed in a coordinated batch release on May 6, 2026, in which VMware and the Spring team published fixes for four vulnerabilities in the Spring Cloud Config ecosystem at once:
| CVE | Vulnerability Type | Severity |
|---|---|---|
| CVE-2026-40982 | Path Traversal | Critical (9.1) |
| CVE-2026-41002 | TOCTOU Race Condition | High (7.2) |
| CVE-2026-40981 | Google Secrets Manager Access | High |
| CVE-2026-41004 | Plaintext Sensitive Data in Trace Logs | Medium (4.4) |
Four security fixes landing together in the same product suggests either a focused security audit of the Spring Cloud Config codebase or a coordinated response to several independent reports. Organizations that upgrade to address CVE-2026-41002 will also remediate the critical path traversal vulnerability (CVE-2026-40982). With a CVSS score of 9.1, that one should be prioritized accordingly.
