RadioCSIRT - WID-SEC-W-2026-2952 - Vulnerability-Lookup

WID-SEC-W-2026-2952

Vulnerability from csaf_certbund - Published: 2026-08-20 22:00 - Updated: 2026-08-27 22:00

Summary

VMware Tanzu Spring Cloud: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: VMware Tanzu Spring Cloud ist eine Plattform zur Bereitstellung und Verwaltung von Spring-Anwendungen in Cloud-Umgebungen unter Verwendung von Microservices-Architekturen.

Angriff: Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Cloud ausnutzen, um Dateien zu manipulieren, um Informationen offenzulegen und um Sicherheitsvorkehrungen zu umgehen.

Betroffene Betriebssysteme: - Linux - Sonstiges - UNIX - Windows

CVE-2026-47836

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
VMware Tanzu Spring Cloud <2025.1.3 VMware Tanzu / Spring Cloud		<2025.1.3

CVE-2026-47837

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-47879

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-47894

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-59284

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-59291

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-59297

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-59298

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-59299

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-59300

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-59301

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-59302

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-59303

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-59304

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-59305

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-59306

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

CVE-2026-59315

Affected products

Known affected 1 product, the same list as for CVE-2026-47836

References

18 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://spring.io/blog/2026/08/20/spring-cloud-20…	external
https://spring.io/security/cve-2026-47836	external
https://spring.io/security/cve-2026-47837	external
https://spring.io/security/cve-2026-47879	external
https://spring.io/security/cve-2026-47894	external
https://spring.io/security/cve-2026-59284	external
https://spring.io/security/cve-2026-59291	external
https://spring.io/security/cve-2026-59297	external
https://spring.io/security/cve-2026-59298	external
https://spring.io/security/cve-2026-59299	external
https://spring.io/security/cve-2026-59300	external
https://spring.io/security/cve-2026-59301	external
https://spring.io/security/cve-2026-59302	external
https://spring.io/security/cve-2026-59303	external
https://spring.io/security/cve-2026-59304	external
https://spring.io/security/cve-2026-59306	external

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "VMware Tanzu Spring Cloud ist eine Plattform zur Bereitstellung und Verwaltung von Spring-Anwendungen in Cloud-Umgebungen unter Verwendung von Microservices-Architekturen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Cloud ausnutzen, um Dateien zu manipulieren, um Informationen offenzulegen und um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2952 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2952.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2952 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2952"
      },
      {
        "category": "external",
        "summary": "Spring Cloud 2025.1.3 (aka Oakwood) Release vom 2026-08-20",
        "url": "https://spring.io/blog/2026/08/20/spring-cloud-2025-1-3-has-been-released"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-47836 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-47836"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-47837 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-47837"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-47879 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-47879"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-47894 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-47894"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-59284 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-59284"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-59291 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-59291"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-59297 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-59297"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-59298 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-59298"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-59299 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-59299"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-59300 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-59300"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-59301 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-59301"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-59302 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-59302"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-59303 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-59303"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-59304 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-59304"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory CVE-2026-59306 vom 2026-08-20",
        "url": "https://spring.io/security/cve-2026-59306"
      }
    ],
    "source_lang": "en-US",
    "title": "VMware Tanzu Spring Cloud: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-08-27T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-28T07:36:11.300+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2952",
      "initial_release_date": "2026-08-20T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-08-20T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-08-26T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-66638, EUVD-2026-66637"
        },
        {
          "date": "2026-08-27T22:00:00.000+00:00",
          "number": "3",
          "summary": "CVE-Nummern erg\u00e4nzt"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2025.1.3",
                "product": {
                  "name": "VMware Tanzu Spring Cloud \u003c2025.1.3",
                  "product_id": "T058442"
                }
              },
              {
                "category": "product_version",
                "name": "2025.1.3",
                "product": {
                  "name": "VMware Tanzu Spring Cloud 2025.1.3",
                  "product_id": "T058442-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_cloud:2025.1.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spring Cloud"
          }
        ],
        "category": "vendor",
        "name": "VMware Tanzu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-47836",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-47836"
    },
    {
      "cve": "CVE-2026-47837",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-47837"
    },
    {
      "cve": "CVE-2026-47879",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-47879"
    },
    {
      "cve": "CVE-2026-47894",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-47894"
    },
    {
      "cve": "CVE-2026-59284",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59284"
    },
    {
      "cve": "CVE-2026-59291",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59291"
    },
    {
      "cve": "CVE-2026-59297",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59297"
    },
    {
      "cve": "CVE-2026-59298",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59298"
    },
    {
      "cve": "CVE-2026-59299",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59299"
    },
    {
      "cve": "CVE-2026-59300",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59300"
    },
    {
      "cve": "CVE-2026-59301",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59301"
    },
    {
      "cve": "CVE-2026-59302",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59302"
    },
    {
      "cve": "CVE-2026-59303",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59303"
    },
    {
      "cve": "CVE-2026-59304",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59304"
    },
    {
      "cve": "CVE-2026-59305",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59305"
    },
    {
      "cve": "CVE-2026-59306",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59306"
    },
    {
      "cve": "CVE-2026-59315",
      "product_status": {
        "known_affected": [
          "T058442"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59315"
    }
  ]
}

CVE-2026-47836 (GCVE-0-2026-47836)

Vulnerability from cvelistv5 – Published: 2026-08-26 17:05 – Updated: 2026-08-27 03:58

Title

Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

Summary

The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 00:00 UTC

CWE

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

vmware mitre root Scorecard

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-47836

Impacted products

1 product

Vendor	Product	Version
Spring	Spring Cloud Config	Affected: 5.0.0 , ≤ 5.0.4 (custom) Affected: 4.3.0 , ≤ 4.3.4 (custom) Affected: 4.0.0 , ≤ 4.2.8 (custom) Affected: 0 , ≤ 3.1.14 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47836",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T03:58:24.390Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Config",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "5.0.4",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.3.4",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.2.8",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1.14",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks.\u003c/p\u003e\u003cp\u003eSpring Cloud Config 5.0.0 - 5.0.4\u003cbr/\u003eSpring Cloud Config 4.3.0 - 4.3.4\u003cbr/\u003eSpring Cloud Config 4.0.0 - 4.2.8\u003cbr/\u003eSpring Cloud Config 3.1.14 and earlier\u003c/p\u003e"
            }
          ],
          "value": "The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks.\nSpring Cloud Config 5.0.0 - 5.0.4\nSpring Cloud Config 4.3.0 - 4.3.4\nSpring Cloud Config 4.0.0 - 4.2.8\nSpring Cloud Config 3.1.14 and earlier"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T17:05:21.979Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-47836"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-47836",
    "datePublished": "2026-08-26T17:05:21.979Z",
    "dateReserved": "2026-05-20T10:00:51.003Z",
    "dateUpdated": "2026-08-27T03:58:24.390Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47837 (GCVE-0-2026-47837)

Vulnerability from cvelistv5 – Published: 2026-08-26 17:08 – Updated: 2026-08-26 18:50

Title

Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

Summary

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 18:42 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

vmware mitre root Scorecard

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-47837

Impacted products

1 product

Vendor	Product	Version
Spring	Spring Cloud Config	Affected: 5.0.0 , ≤ 5.0.4 (custom) Affected: 4.3.0 , ≤ 4.3.4 (custom) Affected: 4.0.0 , ≤ 4.2.8 (custom) Affected: 0 , ≤ 3.1.14 (custom) cpe:2.3:a:spring:spring_cloud_config:::::::: cpe:2.3:a:spring:spring_cloud_config:::::::: cpe:2.3:a:spring:spring_cloud_config:::::::: cpe:2.3:a:spring:spring_cloud_config::::::::

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47837",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:42:02.570846Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T18:50:49.428Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Config",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "5.0.4",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.3.4",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.2.8",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1.14",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:spring:spring_cloud_config:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "5.0.4",
                  "versionStartIncluding": "5.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:spring:spring_cloud_config:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "4.3.4",
                  "versionStartIncluding": "4.3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:spring:spring_cloud_config:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "4.2.8",
                  "versionStartIncluding": "4.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:spring:spring_cloud_config:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.1.14",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server\u0027s /monitor endpoint are not validated.\u003cp\u003eThis issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server\u0027s /monitor endpoint are not validated.\n\nThis issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Webhook requests to Spring Cloud Config Server\u0027s /monitor endpoint are not validated."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T17:15:00.164Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-47837"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-47837",
    "datePublished": "2026-08-26T17:08:51.832Z",
    "dateReserved": "2026-05-20T10:00:51.003Z",
    "dateUpdated": "2026-08-26T18:50:49.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47879 (GCVE-0-2026-47879)

Vulnerability from cvelistv5 – Published: 2026-08-27 05:20 – Updated: 2026-08-27 14:28

Title

Spring Cloud Gateway SSRF and native file access with gRPC

Summary

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-27 14:25 UTC

CWE

CWE-918 Server-Side Request Forgery (SSRF)
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

vmware mitre root Scorecard

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-47879

Impacted products

1 product

Vendor	Product	Version
Spring	Spring Cloud Gateway	Affected: 5.0.0 , ≤ 5.0.2 (custom) Affected: 4.3.0 , ≤ 4.3.5 (custom) Affected: 4.0.0 , ≤ 4.2.9 (custom) Affected: 0 , ≤ 3.1.13 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47879",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-27T14:25:43.054745Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-918",
                "description": "CWE-918 Server-Side Request Forgery (SSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T14:28:03.681Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Gateway",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "5.0.2",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.3.5",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.2.9",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSpring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor.\u003c/p\u003e\u003cp\u003eSpring Cloud Gateway 5.0.0 - 5.0.2\u003cbr/\u003eSpring Cloud Gateway 4.3.0 - 4.3.5\u003cbr/\u003eSpring Cloud Gateway 4.0.0 - 4.2.9\u003cbr/\u003eSpring Cloud Gateway 3.1.13 and earlier\u003c/p\u003e"
            }
          ],
          "value": "Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor.\nSpring Cloud Gateway 5.0.0 - 5.0.2\nSpring Cloud Gateway 4.3.0 - 4.3.5\nSpring Cloud Gateway 4.0.0 - 4.2.9\nSpring Cloud Gateway 3.1.13 and earlier"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:21:30.355Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-47879"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Cloud Gateway SSRF and native file access with gRPC"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-47879",
    "datePublished": "2026-08-27T05:20:24.412Z",
    "dateReserved": "2026-05-20T10:00:58.694Z",
    "dateUpdated": "2026-08-27T14:28:03.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47894 (GCVE-0-2026-47894)

Vulnerability from cvelistv5 – Published: 2026-08-27 05:20 – Updated: 2026-08-27 14:18

Title

Spring Cloud Config Server Native Environment Repository Exposure

Summary

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-27 14:17 UTC

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

vmware mitre root Scorecard

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-47894

Impacted products

1 product

Vendor	Product	Version
Spring	Spring Cloud Config	Affected: 5.0.0 , ≤ 5.0.4 (custom) Affected: 4.3.0 , ≤ 4.3.4 (custom) Affected: 4.0.0 , ≤ 4.2.8 (custom) Affected: 0 , ≤ 3.1.14 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47894",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-27T14:17:25.911049Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T14:18:07.039Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Config",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "5.0.4",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.3.4",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.2.8",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1.14",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSpring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path.\u003c/p\u003e\u003cp\u003eSpring Cloud Config 5.0.0 - 5.0.4\u003cbr/\u003eSpring Cloud Config 4.3.0 - 4.3.4\u003cbr/\u003eSpring Cloud Config 4.0.0 - 4.2.8\u003cbr/\u003eSpring Cloud Config 3.1.14 and earlier\u003c/p\u003e"
            }
          ],
          "value": "Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path.\nSpring Cloud Config 5.0.0 - 5.0.4\nSpring Cloud Config 4.3.0 - 4.3.4\nSpring Cloud Config 4.0.0 - 4.2.8\nSpring Cloud Config 3.1.14 and earlier"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:21:41.754Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-47894"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Cloud Config Server Native Environment Repository Exposure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-47894",
    "datePublished": "2026-08-27T05:20:32.282Z",
    "dateReserved": "2026-05-20T10:01:00.478Z",
    "dateUpdated": "2026-08-27T14:18:07.039Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59284 (GCVE-0-2026-59284)

Vulnerability from cvelistv5 – Published: 2026-08-27 17:57 – Updated: 2026-08-28 18:32

Title

Spring Cloud Commons no allow list for writable env actuator endpoint

Summary

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier

Severity

6.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 18:28 UTC

CWE

CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Assigner

vmware mitre root Scorecard

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59284

Impacted products

1 product

Vendor	Product	Version
Spring	Spring Cloud Commons	Affected: 5.0.0 , ≤ 5.0.2 (custom) Affected: 4.3.0 , ≤ 4.3.3 (custom) Affected: 4.0.0 , ≤ 4.2.6 (custom) Affected: 0 , ≤ 3.1.10 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59284",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T18:28:29.044888Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-915",
                "description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T18:32:18.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Commons",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "5.0.2",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.3.3",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.2.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1.10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThere is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.\u003c/p\u003e\u003cp\u003eSpring Cloud Commons 5.0.0 - 5.0.2\u003cbr/\u003eSpring Cloud Commons 4.3.0 - 4.3.3\u003cbr/\u003eSpring Cloud Commons 4.0.0 - 4.2.6\u003cbr/\u003eSpring Cloud Commons 3.1.10 and earlier\u003c/p\u003e"
            }
          ],
          "value": "There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.\nSpring Cloud Commons 5.0.0 - 5.0.2\nSpring Cloud Commons 4.3.0 - 4.3.3\nSpring Cloud Commons 4.0.0 - 4.2.6\nSpring Cloud Commons 3.1.10 and earlier"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:42.527Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59284"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Cloud Commons no allow list for writable env actuator endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59284",
    "datePublished": "2026-08-27T17:57:42.527Z",
    "dateReserved": "2026-07-04T18:13:26.297Z",
    "dateUpdated": "2026-08-28T18:32:18.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59291 (GCVE-0-2026-59291)

Vulnerability from cvelistv5 – Published: 2026-08-27 17:57 – Updated: 2026-08-28 18:38

Title

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function

Summary

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

Severity

2 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 18:37 UTC

CWE

CWE-918 Server-Side Request Forgery (SSRF)
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

vmware mitre root Scorecard

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59291

Impacted products

1 product

Vendor	Product	Version
Spring	Spring Cloud Function	Affected: 5.0.0 , ≤ 5.0.3 (custom) Affected: 4.3.0 , ≤ 4.3.4 (custom) Affected: 4.2.0 , ≤ 4.2.7 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59291",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T18:37:36.362495Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-918",
                "description": "CWE-918 Server-Side Request Forgery (SSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T18:38:29.352Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Function",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "5.0.3",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.3.4",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.2.7",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePotential arbitrary file read and SSRF vulnerability in Spring Cloud Function.\u003c/p\u003e\u003cp\u003eSpring Cloud Function 5.0.0 - 5.0.3\u003cbr/\u003eSpring Cloud Function 4.3.0 - 4.3.4\u003cbr/\u003eSpring Cloud Function 4.2.0 - 4.2.7\u003c/p\u003e"
            }
          ],
          "value": "Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function.\nSpring Cloud Function 5.0.0 - 5.0.3\nSpring Cloud Function 4.3.0 - 4.3.4\nSpring Cloud Function 4.2.0 - 4.2.7"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:48.943Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59291"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59291",
    "datePublished": "2026-08-27T17:57:48.943Z",
    "dateReserved": "2026-07-04T18:13:34.323Z",
    "dateUpdated": "2026-08-28T18:38:29.352Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59297 (GCVE-0-2026-59297)

Vulnerability from cvelistv5 – Published: 2026-08-27 17:57 – Updated: 2026-08-28 18:35

Title

Spring Cloud Function can incorrectly determine if URI is secure

Summary

Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 18:35 UTC

CWE

CWE-346 Origin Validation Error
CWE-346 - Origin Validation Error

Assigner

vmware mitre root Scorecard

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59297

Impacted products

1 product

Vendor	Product	Version
Spring	Spring Cloud Function	Affected: 5.0.0 , ≤ 5.0.3 (custom) Affected: 4.3.0 , ≤ 4.3.4 (custom) Affected: 4.2.0 , ≤ 4.2.7 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59297",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T18:35:16.332810Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T18:35:31.544Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Function",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "5.0.3",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.3.4",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.2.7",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImplementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme.\u003c/p\u003e\u003cp\u003eSpring Cloud Function 5.0.0 - 5.0.3\u003cbr/\u003eSpring Cloud Function 4.3.0 - 4.3.4\u003cbr/\u003eSpring Cloud Function 4.2.0 - 4.2.7\u003c/p\u003e"
            }
          ],
          "value": "Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme.\nSpring Cloud Function 5.0.0 - 5.0.3\nSpring Cloud Function 4.3.0 - 4.3.4\nSpring Cloud Function 4.2.0 - 4.2.7"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-346 Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:53.989Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59297"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spring Cloud Function can incorrectly determine if URI is secure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59297",
    "datePublished": "2026-08-27T17:57:53.989Z",
    "dateReserved": "2026-07-04T18:13:34.323Z",
    "dateUpdated": "2026-08-28T18:35:31.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59298 (GCVE-0-2026-59298)

Vulnerability from cvelistv5 – Published: 2026-08-27 17:57 – Updated: 2026-09-01 14:59

Title

Potential for improper filtering of HTTP headers in Spring Cloud Function

Summary

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 13:13 UTC

CWE

CWE-20 Improper Input Validation
CWE-20 - Improper Input Validation

Assigner

vmware mitre root Scorecard

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59298

Impacted products

1 product

Vendor	Product	Version
Spring	Spring Cloud Function	Affected: 5.0.0 , ≤ 5.0.3 (custom) Affected: 4.3.0 , ≤ 4.3.4 (custom) Affected: 4.2.0 , ≤ 4.2.7 (custom) Affected: 0 , ≤ 3.2.16 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59298",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T13:13:59.973640Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T14:59:51.550Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Function",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "5.0.3",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.3.4",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.2.7",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.2.16",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePotential for improper filtering of HTTP headers in Spring Cloud Function.\u003c/p\u003e\u003cp\u003eSpring Cloud Function 5.0.0 - 5.0.3\u003cbr/\u003eSpring Cloud Function 4.3.0 - 4.3.4\u003cbr/\u003eSpring Cloud Function 4.2.0 - 4.2.7\u003cbr/\u003eSpring Cloud Function 3.2.16 and earlier\u003c/p\u003e"
            }
          ],
          "value": "Potential for improper filtering of HTTP headers in Spring Cloud Function.\nSpring Cloud Function 5.0.0 - 5.0.3\nSpring Cloud Function 4.3.0 - 4.3.4\nSpring Cloud Function 4.2.0 - 4.2.7\nSpring Cloud Function 3.2.16 and earlier"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Potential for improper filtering of HTTP headers in Spring Cloud Function."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:55.073Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59298"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Potential for improper filtering of HTTP headers in Spring Cloud Function"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59298",
    "datePublished": "2026-08-27T17:57:55.073Z",
    "dateReserved": "2026-07-04T18:13:34.323Z",
    "dateUpdated": "2026-09-01T14:59:51.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59299 (GCVE-0-2026-59299)

Vulnerability from cvelistv5 – Published: 2026-08-27 17:57 – Updated: 2026-08-28 22:48

Title

Composition lookup can potentially poison base function in Spring Cloud Function

Summary

Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 22:43 UTC

CWE

CWE-471 Modification of Assumed-Immutable Data (MAID)
CWE-471 - Modification of Assumed-Immutable Data (MAID)

Assigner

vmware mitre root Scorecard

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59299

Impacted products

1 product

Vendor	Product	Version
Spring	Spring Cloud Function	Affected: 5.0.0 , ≤ 5.0.3 (custom) Affected: 4.3.0 , ≤ 4.3.4 (custom) Affected: 4.2.0 , ≤ 4.2.7 (custom) Affected: 0 , ≤ 3.2.16 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59299",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T22:43:20.472848Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-471",
                "description": "CWE-471 Modification of Assumed-Immutable Data (MAID)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T22:48:12.246Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Function",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "5.0.3",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.3.4",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.2.7",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.2.16",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eComposition lookup can potentially poison base function in Spring Cloud Function.\u003c/p\u003e\u003cp\u003eSpring Cloud Function 5.0.0 - 5.0.3\u003cbr/\u003eSpring Cloud Function 4.3.0 - 4.3.4\u003cbr/\u003eSpring Cloud Function 4.2.0 - 4.2.7\u003cbr/\u003eSpring Cloud Function 3.2.16 and earlier\u003c/p\u003e"
            }
          ],
          "value": "Composition lookup can potentially poison base function in Spring Cloud Function.\nSpring Cloud Function 5.0.0 - 5.0.3\nSpring Cloud Function 4.3.0 - 4.3.4\nSpring Cloud Function 4.2.0 - 4.2.7\nSpring Cloud Function 3.2.16 and earlier"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Composition lookup can potentially poison base function in Spring Cloud Function."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-471 Modification of Assumed-Immutable Data (MAID)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:56.024Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59299"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Composition lookup can potentially poison base function in Spring Cloud Function"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59299",
    "datePublished": "2026-08-27T17:57:56.024Z",
    "dateReserved": "2026-07-04T18:13:46.708Z",
    "dateUpdated": "2026-08-28T22:48:12.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59300 (GCVE-0-2026-59300)

Vulnerability from cvelistv5 – Published: 2026-08-27 17:57 – Updated: 2026-08-28 22:48

Title

Potential for logging sensitive data in Spring Cloud Function AWS

Summary

Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 22:43 UTC

CWE

CWE-532 Insertion of Sensitive Information into Log File
CWE-532 - Insertion of Sensitive Information into Log File

Assigner

vmware mitre root Scorecard

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-59300

Impacted products

1 product

Vendor	Product	Version
Spring	Spring Cloud Function	Affected: 5.0.0 , ≤ 5.0.3 (custom) Affected: 4.3.0 , ≤ 4.3.4 (custom) Affected: 4.2.0 , ≤ 4.2.7 (custom) Affected: 0 , ≤ 3.2.16 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59300",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T22:43:19.447689Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-532",
                "description": "CWE-532 Insertion of Sensitive Information into Log File",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T22:48:05.882Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Function",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "5.0.3",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.3.4",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.2.7",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.2.16",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePotential for logging sensitive data in Spring Cloud Function AWS.\u003c/p\u003e\u003cp\u003eSpring Cloud Function 5.0.0 - 5.0.3\u003cbr/\u003eSpring Cloud Function 4.3.0 - 4.3.4\u003cbr/\u003eSpring Cloud Function 4.2.0 - 4.2.7\u003cbr/\u003eSpring Cloud Function 3.2.16 and earlier\u003c/p\u003e"
            }
          ],
          "value": "Potential for logging sensitive data in Spring Cloud Function AWS.\nSpring Cloud Function 5.0.0 - 5.0.3\nSpring Cloud Function 4.3.0 - 4.3.4\nSpring Cloud Function 4.2.0 - 4.2.7\nSpring Cloud Function 3.2.16 and earlier"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Potential for logging sensitive data in Spring Cloud Function AWS."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-532 Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:57:57.010Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-59300"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Potential for logging sensitive data in Spring Cloud Function AWS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59300",
    "datePublished": "2026-08-27T17:57:57.010Z",
    "dateReserved": "2026-07-04T18:13:46.708Z",
    "dateUpdated": "2026-08-28T22:48:05.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.