Improper access control in Spring Batch - CVE-2026-47875
Published: August 28, 2026
Vulnerability identifier: #VU146235
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47875
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper enforcement of the trusted-types allowlist in JobParameterDeserializer when deserializing execution contexts from an untrusted data source for the job repository. A remote attacker can supply malicious serialized input to execute arbitrary code.
Exploitation is possible in applications that use Jackson2ExecutionContextStringSerializer.
Affected software
Spring Batch
Library Support for Spring
Library Support for Spring
How to mitigate CVE-2026-47875
Install security update from vendor's website.
Spring Batch - addressed in versions 5.2.7, 6.0.4.1, 6.0.5
Library Support for Spring - update to 3.5.19
Library Support for Spring - update to 3.5.19