CVE-2026-47836 is a high severity (CVSS 7.2) race condition in Spring Cloud Config Server. The directory used to clone SVN repositories (spring.cloud.config.server.svn.basedir) is open to time-of-check to time-of-use attacks. The open source fix is Spring Cloud Config 5.0.5. The steps below show how to check your version and what to change.
What's affected
Spring's advisory and the record agree on the affected ranges.
- Spring Cloud Config 5.0.0 to 5.0.4. Fixed in 5.0.5 (open source).
- Spring Cloud Config 4.3.0 to 4.3.4. Fixed in 4.3.5 (Enterprise Support only).
- Spring Cloud Config 4.0.0 to 4.2.8. Fixed in 4.2.9 (Enterprise Support only).
- Spring Cloud Config 3.1.14 and earlier. Fixed in 3.1.15 (Enterprise Support only).
The advisory rates it High. It lists no mitigation other than upgrading. The issue concerns the SVN backend, so setups that only use Git or other backends are not described by the advisory as using this directory.
How to check if you're exposed
For Maven projects, print the resolved version:
mvn dependency:tree | grep spring-cloud-config-server
For Gradle projects:
./gradlew dependencies | grep spring-cloud-config-server
Check the transitive tree, not only your direct dependencies, because Spring components often arrive through a starter or a parent BOM.
Then check whether you use the Subversion backend at all. Look in your Config Server application.yml or properties for a svn repository type or the spring.cloud.config.server.svn.basedir setting. If you do not use SVN, your practical exposure is lower, but you should still plan the upgrade.
What to do now
- Upgrade to Spring Cloud Config 5.0.5 if you are on the 5.0 line.
- On older lines, the fixed versions (4.3.5, 4.2.9, 3.1.15) are available to Enterprise Support customers, so plan a move to a supported open source line if you do not have that subscription.
- Confirm whether your Config Server uses the SVN backend. If not, note that in your risk record.
- Check who has write access to the filesystem path used as the SVN base directory, and tighten it.
Why it matters
The record lists CWE-367, time-of-check to time-of-use. A program checks a condition, such as the state of a directory, and then acts on it later. If something else can change the thing in between, the check no longer means what the program assumed.
The advisory gives few details beyond naming the SVN base directory. In general, these races depend on someone being able to touch the same filesystem location, so the surrounding access controls matter as much as the version. The record does not mark this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I only use a Git backend?
The advisory describes the SVN base directory setting. If you do not use the SVN backend, your exposure is lower, but upgrading is still advised.
Is the fix free for every release line?
The open source fix is 5.0.5. Spring lists fixes for 4.3, 4.2 and 3.1 as Enterprise Support only.
Sources
Last reviewed: 18 October 2026.
