SB2026083150 - Multiple vulnerabilities in Spring Cloud Function
Published: August 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-59291)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to perform server-side request forgery and modify data.
The vulnerability exists due to improper input validation in Spring Cloud Function when processing crafted input. A remote privileged user can send specially crafted input to perform server-side request forgery and modify data.
User interaction is required.
2) Protection mechanism failure (CVE-ID: CVE-2026-59297)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information or affect integrity checks.
The vulnerability exists due to improper security check implementation in the isSecure() implementation of ServerlessHttpServletRequest when determining whether a URI is secure. A remote privileged user can cause the application to incorrectly treat a URI as secure to disclose sensitive information or affect integrity checks.
User interaction is required.
3) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-59298)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information and affect the integrity of HTTP header handling.
The vulnerability exists due to improper filtering in HTTP headers in Spring Cloud Function when handling HTTP requests. A remote privileged user can send a specially crafted request to disclose sensitive information and affect the integrity of HTTP header handling.
User interaction is required.
4) Improper access control (CVE-ID: CVE-2026-59299)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information and modify data.
The vulnerability exists due to improper access control in composition lookup in Spring Cloud Function when resolving composed functions. A remote privileged user can poison the base function lookup to disclose sensitive information and modify data.
User interaction is required.
5) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-59300)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper data exposure in Spring Cloud Function AWS logging when handling function invocations. A remote privileged user can trigger logging of sensitive data to disclose sensitive information.
User interaction is required.
6) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-59301)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to sensitive information exposure in Spring Cloud Function Azure when handling function invocations that are logged. A remote privileged user can trigger logging of sensitive data to disclose sensitive information.
User interaction is required.
Remediation
Install update from vendor's website.