CVE-2026-41001
Predictable Temp Directory in Artemis Auto-configuration
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Predictable Temp Directory in Artemis Auto-configuration
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
- Record
CVE-2026-41001- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-377
- Updated
- 2026-11-02
EUVDEUVD-2026-36211
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
- Record
EUVD-2026-36211- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-ggg2-9786-hwc8
Spring Boot: Predictable Temp Directory in Artemis Auto-configuration
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
- Record
GHSA-ggg2-9786-hwc8- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-377
- Updated
- 2026-11-02
NVD
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
- Record
CVE-2026-41001- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-377
- Updated
- 2026-11-02
OSV
Predictable Temp Directory in Artemis Auto-configuration
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
- Record
CVE-2026-41001- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-377
- Updated
- 2026-11-02
OSVGHSA-ggg2-9786-hwc8
Spring Boot: Predictable Temp Directory in Artemis Auto-configuration
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
- Record
GHSA-ggg2-9786-hwc8- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-377
- Updated
- 2026-11-02
Show 15 moreShow less
OSVRHLW-2026-0a4e3ce968cb9794
Lightwell Security Advisory: spring-boot-autoconfigure 2.7.18.rhlw-00004
Red Hat Lightwell has released org.springframework.boot:spring-boot-autoconfigure 2.7.18.rhlw-00004 with a backported security fix.
CVE-2026-41001: Predictable Temp Directory in Artemis Auto-configuration
This patched artifact is a drop-in replacement for org.springframework.boot:spring-boot-autoconfigure 2.7.18 from Maven Central.
- Record
RHLW-2026-0a4e3ce968cb9794- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1781484842 No score
TuxCare security update for org.springframework.boot:spring-boot-autoconfigure (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-autoconfigure to address 1 CVE. Fixed in 3.3.13-tuxcare.6.
- Record
CLSA-2026-1781484842- Updated
- 2026-11-02
OSVCLSA-2026-1783645377 No score
TuxCare security update for org.springframework.boot:spring-boot-autoconfigure (2 CVEs)
TuxCare rebuilt org.springframework.boot:spring-boot-autoconfigure to address 2 CVEs. Fixed in 2.4.5-tuxcare.4.
- Record
CLSA-2026-1783645377- Updated
- 2026-11-02
OSVCLSA-2026-1783645406 No score
TuxCare security update for org.springframework.boot:spring-boot-autoconfigure (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-autoconfigure to address 1 CVE. Fixed in 2.7.18-tuxcare.19.
- Record
CLSA-2026-1783645406- Updated
- 2026-11-02
OSVCLSA-2026-1784164094 No score
TuxCare security update for org.springframework.boot (7 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 7 CVEs. Fixed in 2.3.6.RELEASE-tuxcare.5.
- Record
CLSA-2026-1784164094- Updated
- 2026-11-02
OSVCLSA-2026-1785291688 No score
TuxCare security update for org.springframework.boot:spring-boot-autoconfigure (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-autoconfigure to address 1 CVE. Fixed in 2.7.16-tuxcare.8.
- Record
CLSA-2026-1785291688- Updated
- 2026-11-02
OSVCLSA-2026-1787668073 No score
TuxCare security update for org.springframework.boot:spring-boot-autoconfigure (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-autoconfigure to address 1 CVE. Fixed in 3.0.13-tuxcare.5.
- Record
CLSA-2026-1787668073- Updated
- 2026-11-02
OSVCLSA-2026-1787671361 No score
TuxCare security update for org.springframework.boot:spring-boot-autoconfigure (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-autoconfigure to address 1 CVE. Fixed in 3.1.8-tuxcare.9.
- Record
CLSA-2026-1787671361- Updated
- 2026-11-02
OSVCLSA-2026-1787673713 No score
TuxCare security update for org.springframework.boot:spring-boot-autoconfigure (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-autoconfigure to address 1 CVE. Fixed in 2.4.6-tuxcare.10.
- Record
CLSA-2026-1787673713- Updated
- 2026-11-02
OSVCLSA-2026-1789225570 No score
TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.3.13-tuxcare.6.
- Record
CLSA-2026-1789225570- Updated
- 2026-11-02
OSVCLSA-2026-1789414950 No score
TuxCare security update for org.springframework.boot (3 CVEs)
TuxCare rebuilt 3 org.springframework.boot packages to address 3 CVEs. Fixed in 3.4.13-tuxcare.3.
- Record
CLSA-2026-1789414950- Updated
- 2026-11-02
OSVCLSA-2026-1793015923 No score
TuxCare security update for org.springframework.boot (3 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 3 CVEs. Fixed in 3.2.12-tuxcare.5.
- Record
CLSA-2026-1793015923- Updated
- 2026-11-02
OSVCLSA-2026-1793741036 No score
TuxCare security update for org.springframework.boot:spring-boot-autoconfigure (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-autoconfigure to address 1 CVE. Fixed in 2.6.15-tuxcare.18.
- Record
CLSA-2026-1793741036- Updated
- 2026-11-04
OSVCLSA-2026-1793805334 No score
TuxCare security update for org.springframework.boot (5 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 5 CVEs. Fixed in 2.7.9-tuxcare.2.
- Record
CLSA-2026-1793805334- Updated
- 2026-11-04
OSVROOT-APP-MAVEN-CVE-2026-41001 No score
CVE-2026-41001 in io.root.org.springframework.boot:spring-boot - Patched by Root
Root has patched CVE-2026-41001 in the io.root.org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-41001- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-autoconfigureMaven |
4.0.0 to 4.0.6 | 4.0.7 |
org.springframework.boot:spring-boot-autoconfigureMaven |
3.5.0 to 3.5.14 | 3.5.15 |
org.springframework.boot:spring-boot-autoconfigureMaven |
3.4.0 to 3.4.16 | None known |
org.springframework.boot:spring-boot-autoconfigureMaven |
3.3.0 to 3.3.19 | None known |
org.springframework.boot:spring-boot-autoconfigureMaven |
2.7.0 to 2.7.33 | None known |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
3.3.13 up to 3.3.13-tuxcare.6, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.33.3.13-tuxcare.43.3.13-tuxcare.5 |
3.3.13-tuxcare.6 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 2 CVEs |
2.4.5 up to 2.4.5-tuxcare.4, plus listed versions 2.4.5-tuxcare.12.4.5-tuxcare.22.4.5-tuxcare.3 |
2.4.5-tuxcare.4 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
2.7.18 up to 2.7.18-tuxcare.19, plus listed versions 2.7.18-tuxcare.102.7.18-tuxcare.112.7.18-tuxcare.122.7.18-tuxcare.132.7.18-tuxcare.14 Show 13 moreShow less2.7.18-tuxcare.152.7.18-tuxcare.162.7.18-tuxcare.172.7.18-tuxcare.182.7.18-tuxcare.82.7.18.tuxcare2.7.18.tuxcare.12.7.18.tuxcare.22.7.18.tuxcare.32.7.18.tuxcare.42.7.18.tuxcare.52.7.18.tuxcare.62.7.18.tuxcare.7 |
2.7.18-tuxcare.19 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
2.7.16 up to 2.7.16-tuxcare.8, plus listed versions 2.7.16-tuxcare.12.7.16-tuxcare.22.7.16-tuxcare.32.7.16-tuxcare.42.7.16-tuxcare.52.7.16-tuxcare.62.7.16-tuxcare.7 |
2.7.16-tuxcare.8 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
3.0.13 up to 3.0.13-tuxcare.5, plus listed versions 3.0.13-tuxcare.13.0.13-tuxcare.23.0.13-tuxcare.33.0.13-tuxcare.4 |
3.0.13-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
3.1.8 up to 3.1.8-tuxcare.9, plus listed versions 3.1.8-tuxcare.13.1.8-tuxcare.23.1.8-tuxcare.33.1.8-tuxcare.43.1.8-tuxcare.53.1.8-tuxcare.63.1.8-tuxcare.73.1.8-tuxcare.8 |
3.1.8-tuxcare.9 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
2.4.6 up to 2.4.6-tuxcare.10, plus listed versions 2.4.6-tuxcare.32.4.6-tuxcare.42.4.6-tuxcare.52.4.6-tuxcare.62.4.6-tuxcare.72.4.6-tuxcare.82.4.6-tuxcare.92.4.6.tuxcare.2 |
2.4.6-tuxcare.10 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 3 CVEs |
3.4.13 up to 3.4.13-tuxcare.3, plus listed versions 3.4.13-tuxcare.13.4.13-tuxcare.2 |
3.4.13-tuxcare.3 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 3 CVEs |
3.4.13 up to 3.4.13-tuxcare.3, plus listed versions 3.4.13-tuxcare.13.4.13-tuxcare.2 |
3.4.13-tuxcare.3 |
org.springframework.boot:spring-boot-starter-mailTuxCare:Maven From an advisory covering 3 CVEs |
3.4.13 up to 3.4.13-tuxcare.3, plus listed versions 3.4.13-tuxcare.13.4.13-tuxcare.2 |
3.4.13-tuxcare.3 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 3 CVEs |
3.2.12 up to 3.2.12-tuxcare.5, plus listed versions 3.2.12-tuxcare.13.2.12-tuxcare.23.2.12-tuxcare.33.2.12-tuxcare.4 |
3.2.12-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 3 CVEs |
3.2.12 up to 3.2.12-tuxcare.5, plus listed versions 3.2.12-tuxcare.13.2.12-tuxcare.23.2.12-tuxcare.33.2.12-tuxcare.4 |
3.2.12-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
2.6.15 up to 2.6.15-tuxcare.18, plus listed versions 2.6.15-tuxcare.102.6.15-tuxcare.112.6.15-tuxcare.122.6.15-tuxcare.132.6.15-tuxcare.14 Show 12 moreShow less2.6.15-tuxcare.152.6.15-tuxcare.162.6.15-tuxcare.172.6.15-tuxcare.22.6.15-tuxcare.32.6.15-tuxcare.42.6.15-tuxcare.52.6.15-tuxcare.62.6.15-tuxcare.72.6.15-tuxcare.82.6.15-tuxcare.92.6.15.tuxcare.1 |
2.6.15-tuxcare.18 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-autoconfigureMaven |
4.0.0 up to 4.0.7, plus listed versions 4.0.14.0.24.0.34.0.44.0.54.0.6 |
4.0.7 |
org.springframework.boot:spring-boot-autoconfigureMaven |
3.5.0 up to 3.5.15, plus listed versions 3.5.13.5.103.5.113.5.123.5.13 Show 9 moreShow less3.5.143.5.23.5.33.5.43.5.53.5.63.5.73.5.83.5.9 |
3.5.15 |
org.springframework.boot:spring-boot-autoconfigureMaven |
3.4.0 to 3.4.16, plus listed versions 3.4.13.4.103.4.113.4.123.4.13 Show 8 moreShow less3.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.9 |
None known |
org.springframework.boot:spring-boot-autoconfigureMaven |
3.3.0 to 3.3.19, plus listed versions 3.3.13.3.103.3.113.3.123.3.13 Show 8 moreShow less3.3.23.3.33.3.43.3.53.3.63.3.73.3.83.3.9 |
None known |
org.springframework.boot:spring-boot-autoconfigureMaven |
2.7.0 to 2.7.33, plus listed versions 2.7.12.7.102.7.112.7.122.7.13 Show 13 moreShow less2.7.142.7.152.7.162.7.172.7.182.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.9 |
None known |
org.springframework.boot:spring-boot-autoconfigureRed Hat Lightwell:Maven |
before 2.7.18.rhlw-00004, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.1.0.RELEASE1.1.1.RELEASE Show 45 moreShow less1.1.10.RELEASE1.1.11.RELEASE1.1.12.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.1.6.RELEASE1.1.7.RELEASE1.1.8.RELEASE1.1.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.2.5.RELEASE1.2.6.RELEASE1.2.7.RELEASE1.2.8.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.4.7.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.10.RELEASE1.5.11.RELEASE1.5.12.RELEASE1.5.13.RELEASE1.5.14.RELEASE1.5.15.RELEASE |
2.7.18.rhlw-00004 |
io.root.org.springframework.boot:spring-bootRoot:Maven |
before 3.5.3-root.io.1 | 3.5.3-root.io.13.5.3-root.io.23.5.3-root.io.34.0.6-root.io.1 |
org.springframework.boot:spring-bootRoot:Maven |
before 3.5.3-aikido.1 | 3.5.3-aikido.13.5.3-aikido.23.5.3-aikido.34.0.6-aikido.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases | OSV | |
| affected, aliases, facts | OSV | |
| affected | ||
| affected, affected_more | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41001 is a medium vulnerability (CVSS 5.3) in Spring Boot, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.09%, the 0th percentile. Fixed in org.springframework.boot:spring-boot-autoconfigure 4.0.7.
References
spring.io/security/cve-2026-41001
nvd.nist.gov/vuln/detail/CVE-2026-41001
github.com/spring-projects/spring-boot/commit/4218bd76e934e5cf9e3fd3997c67b8a6b0d0c111
Left out here: 136 versions. The JSON record has them.