CVE-2026-47836
Description
A flaw was found in Spring Cloud Config Server. The base directory used by the server to clone SVN repositories is susceptible to a Time-of-Check Time-of-Use (TOCTOU) attack. A local attacker with high privileges could exploit this vulnerability by manipulating the directory between the security check and its subsequent use. This could lead to unauthorized modification of files or disclosure of sensitive information.
Statement
Important: The Spring Cloud Config Server is vulnerable to a Time-of-Check Time-of-Use (TOCTOU) attack within its SVN base directory. Exploitation requires a local attacker with high privileges to manipulate the directory, potentially leading to unauthorized modification of configuration files or disclosure of sensitive data. This risk is present in Red Hat deployments where Spring Cloud Config Server is configured to use SVN repositories.
Mitigation
To mitigate this issue, ensure that the `spring.cloud.config.server.svn.basedir` and the directory where the Spring Cloud Config Server application runs have strict file system permissions, limiting write access to only the necessary service accounts. If SVN repository support is not required, disable it by removing or commenting out the `spring.cloud.config.server.svn.basedir` configuration property from the application's configuration. Restarting the Spring Cloud Config Server application is required for changes to take effect.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
