Loading vulnerability…
Predictable Temporary Directory in Spring Boot Artemis Auto-configuration
CVE-2026-41001 is an improper temporary file handling vulnerability in Spring Boot's ArtemisEmbeddedConfigurationFactory, part of spring-boot-autoconfigure. When no explicit data directory is configured for the embedded Artemis message broker, the factory uses a fixed, predictable directory. A local attacker can pre-create that directory or place a symbolic link before application startup, causing the broker to use attacker-controlled storage or a redirected location. Affected Spring Boot versions are 4.0.0–4.0.6, 3.5.0–3.5.14, 3.4.0–3.4.16, 3.3.0–3.3.19, and 2.7.0–2.7.33.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can expose or permit manipulation of broker data, enable malicious message injection, and disrupt broker operation. The vulnerability is rated Medium, with a CVSS v3 score of 5.3 and low confidentiality, integrity, and availability impacts. Code execution through deserialization of attacker-controlled journal data is a potential secondary consequence, not an established unconditional outcome.
If you can’t patch tonight, do this now.
Explicitly configure the embedded Artemis broker to use a dedicated, securely provisioned data directory instead of the predictable default. Ensure untrusted local users cannot create, replace, or modify the directory or its parent directories, and verify ownership and the absence of unexpected symbolic links before startup. Restrict untrusted local access to shared hosts until patched versions are deployed.
Patch, then assume compromise.
Upgrade Spring Boot and its aligned dependencies to a fixed release for the applicable branch: 4.0.7 or later in 4.0.x, or 3.5.15 or later in 3.5.x. Enterprise-supported fixes are also identified as 4.0.6.1, 3.5.14.1, 3.4.17, 3.3.20, and 2.7.34. Deployments on unsupported branches should migrate to a supported fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.