CVE-2026-41001
Fixed in a distro release EPSS <1%CVSS 5.3
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
Products: Spring Boot
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework.boot:spring-boot-autoconfigure | 4.0.7 |
| Maven | org.springframework.boot:spring-boot-autoconfigure | 3.5.15 |
| Maven | org.springframework.boot:spring-boot-autoconfigure | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-nifi-registry-2.11 | 2.11.0-r3 |
| Chainguard | camunda-zeebe-8.6 | 8.6.39-r11 |
| Chainguard | kayenta-2025.2 | no fix |
| Chainguard | kayenta-fips-2025.2 | no fix |
| Chainguard | keycloak-config-cli | no fix |
| Chainguard | keycloak-config-cli-iamguarded-compat | no fix |
| Chainguard | ontop | no fix |
| Chainguard | ontop-fips | no fix |
| Chainguard | seata-server | no fix |
| Wolfi | keycloak-config-cli | no fix |
| Wolfi | keycloak-config-cli-iamguarded-compat | no fix |