CVE-2026-59302

Undergoing Analysis Undergoing Analysis - In Progress

Sensitive Data Exposure in Spring Cloud Stream

Publication date: 2026-08-27

Last updated on: 2026-08-28

Assigner: VMware

Description

Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-28

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59302

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_cloud_stream	From 5.0.0 (inc) to 5.0.2 (inc)
vmware	spring_cloud_stream	From 4.3.0 (inc) to 4.3.3 (inc)
vmware	spring_cloud_stream	From 4.2.0 (inc) to 4.2.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

CVE-2026-59302 is a vulnerability in Spring Cloud Stream where sensitive data may be logged. It affects versions 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6. The issue involves potential exposure of confidential information through logging mechanisms.

Detection Guidance

Detection involves checking for sensitive data in logs. Review application logs for entries containing passwords, tokens, or PII. Use grep commands like 'grep -i "password\|token\|secret" /var/log/application.log' to search for sensitive data patterns.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to sensitive data if logs are viewed by malicious actors. It may also result in compliance violations and reputational damage due to data exposure.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if sensitive data is logged and exposed. Organizations may face fines or penalties for failing to protect personal or health information.

Mitigation Strategies

Upgrade to fixed versions: 5.0.3 for OSS, 4.3.4 for Enterprise Support Only, or 4.2.7 for Enterprise Support Only. No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-59302. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70