Improper access control in Spring Cloud Function - CVE-2026-59299
Published: August 31, 2026
Vulnerability identifier: #VU146390
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59299
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information and modify data.
The vulnerability exists due to improper access control in composition lookup in Spring Cloud Function when resolving composed functions. A remote privileged user can poison the base function lookup to disclose sensitive information and modify data.
User interaction is required.
Affected software
Spring Cloud Function
Library Support for Spring
Library Support for Spring
How to mitigate CVE-2026-59299
Install security update from vendor's website.
Spring Cloud Function - addressed in versions 3.2.17, 4.2.8, 4.3.5, 5.0.4
Library Support for Spring - update to 3.5.19
Library Support for Spring - update to 3.5.19