What is GHSA-86wq-234q-r6wg?

GHSA-86wq-234q-r6wg is a security advisory published by GitHub Security Advisories with High severity. Spring Cloud Config Server Susceptible To TOCTOU Attack

Which CVE IDs does GHSA-86wq-234q-r6wg cover?

GHSA-86wq-234q-r6wg covers the following CVE IDs: CVE-2026-41002. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-86wq-234q-r6wg?

GHSA-86wq-234q-r6wg has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-86wq-234q-r6wg?

GHSA-86wq-234q-r6wg affects 6 products, including: maven/org.springframework.cloud:spring-cloud-config-server:\u003e= 3.1.0, \u003c= 3.1.13; maven/org.springframework.cloud:spring-cloud-config-server:\u003e= 4.1.0, \u003c= 4.1.9; maven/org.springframework.cloud:spring-cloud-config-server:\u003e= 4.2.0, \u003c= 4.2.6; maven/org.springframework.cloud:spring-cloud-config-server:\u003e= 4.3.0, \u003c= 4.3.2; maven/org.springframework.cloud:spring-cloud-config-server:\u003e= 5.0.0, \u003c= 5.0.2; and others — see the full list on the advisory page.

GHSA-86wq-234q-r6wgHighCVSS 7.2

Spring Cloud Config Server Susceptible To TOCTOU Attack

Vendor

GitHub Security Advisories

Published

May 7, 2026

Last Modified

June 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-41002 →

📋 Description

The base directory (spring.cloud.config.server.git.basedir) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks.

Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 (inclusive); no open-source upgrade available.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); no open-source upgrade available.
Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); no open-source upgrade available.
Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); no open-source upgrade available.
Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater.
Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

🎯 Affected products6

maven/org.springframework.cloud:spring-cloud-config-server:>= 3.1.0, <= 3.1.13
maven/org.springframework.cloud:spring-cloud-config-server:>= 4.1.0, <= 4.1.9
maven/org.springframework.cloud:spring-cloud-config-server:>= 4.2.0, <= 4.2.6
maven/org.springframework.cloud:spring-cloud-config-server:>= 4.3.0, <= 4.3.2
maven/org.springframework.cloud:spring-cloud-config-server:>= 5.0.0, <= 5.0.2
maven/org.springframework.cloud:spring-cloud-config-server:>= 3.0.0, <= 3.0.7

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products6

🔗 References (3)