CVE-2026-40977: VMware Spring Boot Privilege Escalation

CVE-2026-40977 Overview

CVE-2026-40977 affects Spring Boot applications configured with ApplicationPidFileWriter. A local attacker with write access to the PID file's directory can leverage symbolic link behavior to corrupt arbitrary files on the host. Each application startup triggers one file corruption operation, enabling persistent abuse across service restarts. The flaw is classified as a link-following weakness [CWE-59] and impacts multiple supported Spring Boot release branches. VMware addressed the issue across versions 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33.

Critical Impact
Local attackers with filesystem write access to the PID file location can overwrite sensitive files, including configuration files or system binaries the Spring Boot process can write to, undermining host integrity and availability.

Affected Products

Spring Boot 4.0.0 through 4.0.5 (fixed in 4.0.6)
Spring Boot 3.5.0 through 3.5.13 (fixed in 3.5.14), 3.4.0 through 3.4.15 (fixed in 3.4.16), 3.3.0 through 3.3.18 (fixed in 3.3.19)
Spring Boot 2.7.0 through 2.7.32 (fixed in 2.7.33); unsupported versions are also affected

Discovery Timeline

2026-04-28 - CVE-2026-40977 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-40977

Vulnerability Analysis

The vulnerability resides in Spring Boot's ApplicationPidFileWriter, a utility that records the process ID of a running application to a file on disk. When the application starts, the writer opens the configured PID path and writes the current process ID into it. The writer does not validate whether the target path is a symbolic link prior to writing.

A local attacker who controls the directory hosting the PID file can place a symlink at the expected PID path before application startup. The symlink redirects the write operation to an arbitrary file accessible to the Spring Boot process. The writer truncates and overwrites that target with the PID, corrupting the destination. Because the operation repeats on every restart, the attacker gains a reliable file-clobbering primitive tied to service lifecycle events.

Impact scales with the privileges of the Spring Boot process. Applications running as elevated users may have configuration files, logs, or system files overwritten, producing integrity loss and denial of service. The issue is tracked under CWE-59: Improper Link Resolution Before File Access.

Root Cause

The ApplicationPidFileWriter opens the configured path without using NOFOLLOW semantics or verifying that the path is a regular file owned by the expected user. The write proceeds through any symbolic link present at the path.

Attack Vector

Exploitation requires local access and write permission to the directory holding the PID file. The attacker creates a symlink at the PID path pointing to a target file the Spring Boot process can write. On application start, the writer follows the symlink and overwrites the target with the application PID. See the Spring Security Advisory CVE-2026-40977 for vendor technical details.

Detection Methods for CVE-2026-40977

Indicators of Compromise

Symbolic links present at the configured PID file path that resolve to files outside the application's working directory
Unexpected file modification timestamps on sensitive configuration files coinciding with Spring Boot service start events
PID file contents appearing inside non-PID files such as configuration files, logs, or scripts

Detection Strategies

Audit filesystem telemetry for symlink or link syscalls targeting the PID file path created by non-application users
Correlate Spring Boot startup events with file write events to paths outside the expected PID directory
Inspect running Spring Boot deployments and enumerate which use ApplicationPidFileWriter along with the configured spring.pid.file location

Monitoring Recommendations

Enable file integrity monitoring on directories holding PID files and on any file paths potentially reachable by the Spring Boot service account
Log and alert on creation of symbolic links inside service runtime directories by unprivileged users
Review service account permissions to confirm Spring Boot processes cannot write to sensitive system paths

How to Mitigate CVE-2026-40977

Immediate Actions Required

Upgrade Spring Boot to a patched release: 4.0.6, 3.5.14, 3.4.16, 3.3.19, or 2.7.33
Move PID files to a directory writable only by the Spring Boot service account, such as /var/run/<app>/ with restrictive ownership
Remove write permissions for other local users on any directory currently holding application PID files

Patch Information

VMware released fixed Spring Boot versions 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33. Unsupported branches remain vulnerable and require upgrade to a supported, patched line. Refer to the Spring Security Advisory CVE-2026-40977 for full version guidance.

Workarounds

Disable ApplicationPidFileWriter if PID file output is not required by the deployment
Configure the PID path to a directory whose permissions restrict write access to the application user only
Run Spring Boot under a dedicated low-privilege service account to limit the set of files an attacker could overwrite through the symlink primitive

bash

# Restrict PID directory ownership and permissions
sudo mkdir -p /var/run/myapp
sudo chown appuser:appuser /var/run/myapp
sudo chmod 700 /var/run/myapp

# Point Spring Boot at the protected PID location
# application.properties
# spring.pid.file=/var/run/myapp/application.pid