CVE-2026-47836: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition in Spring Spring Cloud Config

The vulnerability CVE-2026-47836 in Spring Cloud Config Server involves a TOCTOU race condition in the handling of the base directory (spring.cloud.config.server.svn.basedir) used for cloning SVN repositories. This race condition can be exploited by an attacker to manipulate the directory state between the time it is checked and the time it is used, potentially leading to unauthorized access or modification of configuration data. The affected versions include 3.1.14 and earlier, 4.0.0 through 4.2.8, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.4. The CVSS v3.1 score is 7.2, indicating high severity with attack vector local, high attack complexity, high privileges required, no user interaction, scope changed, and high impact on confidentiality and integrity but no impact on availability. No vendor advisory or patch is currently available to address this issue.

Successful exploitation of this TOCTOU race condition could allow an attacker with local access and high privileges to manipulate the base directory used by Spring Cloud Config Server for SVN repository cloning. This could lead to unauthorized disclosure or modification of configuration data, impacting confidentiality and integrity. Availability is not affected. The vulnerability requires high attack complexity and privileges, and no user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting local access to the Spring Cloud Config Server environment and monitoring for suspicious activity related to SVN repository cloning directories. Avoid running the service with unnecessary elevated privileges to reduce risk.