CVE-2026-59326
Received Received - Intake

Spring Tools Proxy Credential Disclosure via Environment Logging

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VMware

Description
The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentials in the form http://user:pass@proxy:8080, and the language server writes this value to its log file without any redaction. Since language server log files are often attached to bug reports or are readable by other local users/processes, this can result in disclosure of proxy credentials. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-30
AI Q&A
2026-07-30
EPSS Evaluated
N/A
NVD
CVE-2026-59326
EUVD
EUVD-2026-50979

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
spring tools_for_eclipse to 5.2.0 (inc)
spring tools_for_vscode to 2.2.0 (inc)
spring tools_for_eclipse to 5.3.0 (exc)
spring tools_for_vscode to 2.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Spring Boot language server logging proxy credentials in plaintext at INFO level when creating outbound HTTP clients. This happens if no explicit proxy workspace setting is configured and the environment variables contain Basic-auth credentials in the format http://user:pass@proxy:8080.

Detection Guidance

Check language server logs for entries containing http_proxy, HTTPS_PROXY, http_proxy, or HTTP_PROXY environment variables with credentials in the format user:pass@proxy:8080. Search logs for strings like 'http://user:pass@' or similar patterns.

Impact Analysis

The vulnerability can lead to disclosure of proxy credentials if language server log files are shared in bug reports or accessed by other local users. Corporate proxy URLs often include Basic-auth credentials, which are exposed in logs without redaction.

Mitigation Strategies

Upgrade to Spring Tools for Eclipse 5.3.0 or Spring Tools for VSCode/Cursor/Theia 2.3.0. As a temporary measure, avoid embedding credentials in proxy environment variables and treat language server log files as sensitive before sharing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59326. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart