Inclusion of Sensitive Information in Log Files in Spring Cloud Function - CVE-2026-59300
Published: August 31, 2026
Vulnerability identifier: #VU146392
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59300
CWE-ID: CWE-532
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper data exposure in Spring Cloud Function AWS logging when handling function invocations. A remote privileged user can trigger logging of sensitive data to disclose sensitive information.
User interaction is required.
Affected software
Spring Cloud Function
Library Support for Spring
Library Support for Spring
How to mitigate CVE-2026-59300
Install security update from vendor's website.
Spring Cloud Function - addressed in versions 3.2.17, 4.2.8, 4.3.5, 5.0.4
Library Support for Spring - update to 3.5.19
Library Support for Spring - update to 3.5.19