Executive brief
Spring Cloud Config Server, a tool used to manage configuration settings for distributed applications, is vulnerable to a race condition during file operations. An attacker with high-level local access could exploit this to manipulate the directory where configuration files are stored, potentially leading to unauthorized access or modification of sensitive application settings. This could compromise the integrity and confidentiality of the configurations used by various services in an organization's infrastructure.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) vulnerability (CWE-367) exists in Spring Cloud Config Server's handling of the 'spring.cloud.config.server.git.basedir' property. The application checks the state of the base directory used for cloning Git repositories, but the state can be modified by a local attacker between the check and the actual use. Exploitation requires high privileges and local access, but can result in a scope change allowing the attacker to read or modify sensitive configuration data. Patches are available in versions 4.3.3 and 5.0.3; older major versions (3.0.x, 3.1.x, 4.1.x, 4.2.x) currently have no open-source upgrade path.
Affected products
- VMware Spring Cloud Config Server 3.0.0-3.0.7, 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, 5.0.0-5.0.2
Timeline
- 2026-05-07: disclosed
- 2026-05-07: advisory
References
- https://api.github.com/users/scottfrederick
- https://github.com/scottfrederick
- https://api.github.com/users/scottfrederick/gists%7B/gist_id%7D
- https://api.github.com/users/scottfrederick/repos
- https://avatars.githubusercontent.com/u/60661?v=4
- https://api.github.com/users/scottfrederick/events%7B/privacy%7D