Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.

oracle CPUOct2026: MySQL Cluster >=9.7.0|<=9.7.4

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.38

oracle CPUOct2026: MySQL Cluster >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.50

oracle CPUOct2026: MySQL Cluster >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Server >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=9.7.0|<=9.7.4

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis
    message broker's data directory when no explicit path is configured. A local attacker on the same host can
    pre-create this predictable directory or place a symlink before the application starts. Affected versions:
    Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0
    through 2.7.33. (CVE-2026-41001)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis     message broker's data directory when no explicit path is configured. A local attacker on the same host can     pre-create this predictable directory or place a symlink before the application starts. Affected versions:
    Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0     through 2.7.33. (CVE-2026-41001)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464770	Echo: org.springframework.boot:spring-boot-autoconfigure: security update to 3.5.15	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464770	Echo: org.springframework.boot:spring-boot-autoconfigure: security update to 3.5.15	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
446215	SCA: security update for org.springframework.boot:spring-boot-autoconfigure (GHSA-ggg2-9786-hwc8)	Tenable Cloud Security	SCA Checks	Local	medium
446215	SCA: security update for org.springframework.boot:spring-boot-autoconfigure (GHSA-ggg2-9786-hwc8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
325156	Linux Distros Unpatched Vulnerability : CVE-2026-41001	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-41001

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium