CVE-2026-47836: Spring Cloud Config TOCTOU Vulnerability

CVE-2026-47836 Overview

CVE-2026-47836 affects the Spring Cloud Config Server when configured to clone Subversion (SVN) repositories. The base directory defined by spring.cloud.config.server.svn.basedir is susceptible to a time-of-check-time-of-use (TOCTOU) race condition. An attacker with local access and high privileges can exploit the timing gap between validation and file operations to compromise files outside the intended directory. The flaw impacts multiple release branches of Spring Cloud Config and can affect confidentiality and integrity of data on the host running the Config Server.

Critical Impact
Local attackers can leverage a race condition against the SVN base directory to read or modify files with the privileges of the Spring Cloud Config Server process.

Affected Products

Spring Cloud Config 5.0.0 through 5.0.4
Spring Cloud Config 4.3.0 through 4.3.4, and 4.0.0 through 4.2.8
Spring Cloud Config 3.1.14 and earlier

Discovery Timeline

2026-08-26 - CVE-2026-47836 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47836

Vulnerability Analysis

Spring Cloud Config Server can clone remote SVN repositories into a local working directory defined by spring.cloud.config.server.svn.basedir. The server checks properties of this directory before performing file operations on its contents. Between the check and the subsequent operation, a local attacker with access to the file system can substitute the directory or its children with a symbolic link or replaced path. When the server later acts on the path, it operates on attacker-controlled targets instead of the originally validated location. This classifies as a TOCTOU race condition [CWE-367] with file system manipulation properties similar to symlink attacks [CWE-59].

Root Cause

The root cause is non-atomic handling of the SVN base directory. The Config Server validates directory attributes and paths separately from the file operations that follow. Because the validation and use are not performed atomically against the same file descriptor or with race-safe primitives, the state of the path can change between the two steps. Any local user able to modify entries within or adjacent to the configured basedir can win the race.

Attack Vector

Exploitation requires local access to the host and privileges sufficient to modify entries in the SVN base directory path. The attacker prepares a target path, waits for the Config Server to perform its check on the intended location, and then replaces the path with a symbolic link pointing to a sensitive file or directory before the follow-up operation runs. The scope changes because the Config Server process may access files outside its intended trust boundary, resulting in disclosure or modification of protected data.

No public proof-of-concept exploit is available. See the Spring Security advisory for CVE-2026-47836 for authoritative technical detail.

Detection Methods for CVE-2026-47836

Indicators of Compromise

Unexpected symbolic links appearing inside or adjacent to the directory configured via spring.cloud.config.server.svn.basedir.
Spring Cloud Config Server log entries showing SVN operations against files outside the expected repository layout.
File modifications in system paths where the timestamp correlates with Config Server SVN refresh events.

Detection Strategies

Audit the running configuration of every Spring Cloud Config Server instance and confirm the SVN base directory is not shared with untrusted local users.
Enable file integrity monitoring on the SVN base directory and its parent directories to alert on link creation and ownership changes.
Correlate Spring Cloud Config Server access logs with local auditd or Windows Security events showing file creation, rename, and link operations under basedir.

Monitoring Recommendations

Monitor the Spring Cloud Config Server process for file access outside the configured repository tree using kernel-level telemetry.
Alert on any local shell session or scheduled task that writes to the SVN base directory while the Config Server is actively cloning or refreshing.
Track version banners exposed by /actuator/info endpoints to inventory hosts still running affected Spring Cloud Config releases.

How to Mitigate CVE-2026-47836

Immediate Actions Required

Upgrade Spring Cloud Config to a fixed release line published by the Spring team as noted in the Spring Security advisory.
Restrict local shell and file system access on hosts running Spring Cloud Config Server to administrators only.
Place the SVN base directory on a dedicated path owned exclusively by the Config Server service account with mode 0700.

Patch Information

Spring has published fixed versions for the affected 3.1.x, 4.0.x through 4.3.x, and 5.0.x branches. Consult the Spring Security advisory for CVE-2026-47836 for the exact patched versions and migration notes before upgrading.

Workarounds

Disable the SVN backend and use Git-based configuration sources if SVN is not required.
Set the spring.cloud.config.server.svn.basedir property to a path that only the Config Server service account can traverse or modify.
Mount the SVN base directory on a file system with nosymfollow or equivalent controls to block symbolic link substitution.

bash

# Configuration example: harden the SVN basedir permissions
sudo install -d -o springcloud -g springcloud -m 0700 /var/lib/spring-cloud-config/svn
# application.yml
# spring:
#   cloud:
#     config:
#       server:
#         svn:
#           basedir: /var/lib/spring-cloud-config/svn