CVE-2026-59292

Analyzed Analyzed - Analysis Complete

Information Disclosure in Spring Integration

Publication date: 2026-08-27

Last updated on: 2026-08-31

Assigner: VMware

Description

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59292

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_integration	From 6.4.0 (inc) to 6.4.13 (exc)
vmware	spring_integration	From 6.5.0 (inc) to 6.5.11 (exc)
vmware	spring_integration	From 7.0.0 (inc) to 7.0.5.1 (exc)
vmware	spring_integration	From 7.1.0 (inc) to 7.1.0.1 (exc)
vmware	spring_integration	to 5.5.22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability involves a file-based metadata store in Spring Integration that creates a file named metadata-store.properties in the system's temporary directory with world-readable permissions. This allows any local user to access sensitive metadata such as processed message keys or offsets.

Detection Guidance

Check for the existence of metadata-store.properties in the system's temporary directory, typically located at ${java.io.tmpdir}/spring-integration/. Verify file permissions to ensure they are not world-readable. Use commands like 'ls -la ${java.io.tmpdir}/spring-integration/metadata-store.properties' on POSIX systems.

Impact Analysis

An attacker with local access could read sensitive metadata stored in the file, potentially exposing internal system information like message processing details or idempotency markers. This could aid in further attacks or data exfiltration.

Compliance Impact

This vulnerability may violate compliance requirements that mandate protection of sensitive data, such as GDPR's data confidentiality principles or HIPAA's safeguards for protected health information, due to unauthorized local access to metadata.

Mitigation Strategies

Upgrade to fixed versions of Spring Integration: 7.1.1, 7.0.6, 6.5.11, 6.4.13, or 5.5.22. No additional mitigation is required after upgrading. Ensure enterprise support versions are updated if applicable.

Hi! I’m here to help you understand CVE-2026-59292. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70