CVE-2026-59297: CWE-346 Origin Validation Error in Spring Spring Cloud Function

The vulnerability CVE-2026-59297 in Spring Cloud Function involves an implementation flaw in the isSecure() method of ServerlessHttpServletRequest, where the actual scheme is not verified. This constitutes an origin validation error (CWE-346). Affected versions include 4.2.0 to 4.2.7, 4.3.0 to 4.3.4, and 5.0.0 to 5.0.3. The CVSS v3.1 score is 3.1, indicating low severity, with attack vector network, high attack complexity, requiring high privileges and user interaction, and impacts confidentiality and integrity with low impact and no availability impact. No official patch or remediation level is provided in the available data.

The vulnerability may allow an attacker to bypass origin validation checks due to improper scheme verification, potentially leading to limited confidentiality and integrity impacts. However, exploitation requires high privileges and user interaction, and the overall severity is low. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should monitor vendor communications for updates and consider mitigating controls if applicable.