SB20260828167 - Multiple vulnerabilities in Spring Cloud Config

Description

This security bulletin contains information about 3 vulnerabilities.

1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-47836)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose sensitive information and modify data.

The vulnerability exists due to a time-of-check time-of-use race condition in the SVN base directory handling of Spring Cloud Config Server when cloning SVN repositories to the configured base directory. A local privileged user can manipulate the base directory during repository operations to disclose sensitive information and modify data.

This issue affects deployments that use SVN as the backend repository.

2) Input validation error (CVE-ID: CVE-2026-47837)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in the /monitor endpoint when handling webhook requests. A remote privileged user can send a crafted webhook request to cause a denial of service.

3) Improper access control (CVE-ID: CVE-2026-47894)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the native environment repository when resolving configuration file paths. A remote privileged user can access files outside of the configured repository path to disclose sensitive information.

Remediation

Install update from vendor's website.

References

• https://spring.io/security/cve-2026-47836
• https://spring.io/security/cve-2026-47837
• https://spring.io/security/cve-2026-47894