CVE-2026-41001: Spring Boot Artemis Embedded Message Broker Local Privilege Escalation

Technical summary

CVE-2026-41001 is a local insecure temporary file handling vulnerability in Spring Boot's ArtemisEmbeddedConfigurationFactory. When the Artemis message broker is embedded and no explicit data directory path is supplied via configuration, the factory uses a hardcoded, predictable default location. An attacker with local user privileges can exploit the race condition or predictability by creating a symlink or directory at that path before the Spring Boot application initializes. This results in Time-of-Check-Time-of-Use (TOCTOU) behavior allowing unauthorized access to or manipulation of the broker's persistent data (CWE-377). The vulnerability affects Spring Boot versions spanning multiple major and minor releases: 4.0.0–4.0.6, 3.5.0–3.5.14, 3.4.0–3.4.16, 3.3.0–3.3.19, and 2.7.0–2.7.33.

Business impact

Organizations relying on embedded Artemis within Spring Boot deployments may face data confidentiality breaches (unauthorized access to message queue data), message integrity violations (tampering with queued messages), and service availability risks (denial of service or corruption forcing restart). Multi-tenant or shared-host environments are particularly exposed. In production systems where message brokers handle sensitive transactional data or cross-application communication, exploitation could cascade into system-wide failures or data leakage events requiring incident response and forensic investigation.

Affected systems

Spring Boot applications using ArtemisEmbeddedConfigurationFactory without an explicitly configured data directory are vulnerable. This affects versions 2.7.0–2.7.33, 3.3.0–3.3.19, 3.4.0–3.4.16, 3.5.0–3.5.14, and 4.0.0–4.0.6. Vulnerability scope is limited to systems where: (1) embedded Artemis is active, (2) no explicit data directory path is provided in configuration, and (3) a local attacker has access to the host. Containerized deployments, Kubernetes clusters, and shared VM/cloud environments are at heightened risk.

Exploitability

Exploitability is straightforward for local attackers. The attack vector is local with low complexity and low privilege requirements (a standard user account suffices). No user interaction is required. An attacker need only create a symlink or directory at the predictable default path before or during application startup. However, attack surface is bounded to authenticated local access—remote exploitation is not possible. CVSS score of 5.3 (MEDIUM) reflects this local-only, low-complexity nature, with modest confidentiality, integrity, and availability impact per the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Remediation

Update Spring Boot to a patched version addressing this directory handling issue. Additionally, hardening measures include: (1) explicitly configuring a secure, non-predictable data directory path for Artemis in application properties, (2) restricting local filesystem permissions to prevent symlink creation or pre-creation of directories in sensitive paths, (3) running Spring Boot containers with minimal privilege and isolated filesystem namespaces, and (4) monitoring for suspicious symlink or directory creation near expected Artemis data locations.

Patch guidance

Verify the availability of patched Spring Boot releases from the official Spring Boot release notes and security advisories. Apply the earliest patch version available for your currently deployed Spring Boot major/minor version line (e.g., if running 3.5.x, patch to the latest 3.5.z release that addresses this vulnerability). Test patches in a pre-production environment, particularly for message broker functionality and data persistence. If a patch is unavailable for your version, implement the workaround of explicitly configuring the Artemis data directory path in your application configuration until an official patch is available.

Detection guidance

Monitor systems for: (1) symlink creation or unusual filesystem activity in predictable default Artemis data directory paths, (2) Spring Boot application startup failures or errors related to Artemis broker initialization (may indicate directory pre-creation or permission issues introduced by attackers), (3) unexpected ownership or permission changes on Artemis data files, (4) audit logs indicating local user privilege escalation or unauthorized access to message broker data. Log aggregation and file integrity monitoring (FIM) tools are valuable for early detection. Code review of application configuration should verify that Artemis data directories are explicitly set rather than relying on defaults.

Why prioritize this

Although CVSS 5.3 is rated MEDIUM, prioritization should reflect your specific environment. In shared-host, container orchestration, or multi-tenant deployments with untrusted users, this vulnerability rises in priority due to ease of exploitation and potential for lateral movement or data theft. In isolated, single-user, or tightly controlled environments, it remains lower priority. Organizations running embedded Artemis in performance-sensitive message-driven applications should prioritize patching to prevent potential data manipulation or service disruption.

Risk score, explained

CVSS 3.1 score of 5.3 (MEDIUM) is justified by: Attack Vector = Local (no remote attack possible), Access Complexity = Low (predictable path, no special conditions), Privileges Required = Low (standard user account sufficient), User Interaction = None (automatic exploitation possible), Scope = Unchanged (impact confined to vulnerable component), Confidentiality Impact = Low (message data may be read), Integrity Impact = Low (message data may be modified), Availability Impact = Low (service may be disrupted or message broker corrupted). The score would be higher in remote-attack or privilege-escalation scenarios; the local-only attack vector caps the severity despite the ease of exploitation.

Frequently asked questions