CVE-2026-59300: CWE-532 Insertion of Sensitive Information into Log File in Spring Spring Cloud Function
Description
CVE-2026-59300 is a low severity vulnerability in Spring Cloud Function that involves the potential insertion of sensitive information into log files. It affects multiple versions of Spring Cloud Function, including 3.2.16 and earlier, 4.2.0 through 4.2.7, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.3. The vulnerability relates to logging sensitive data in the AWS environment. A patch is available, and since this is a cloud service, the vendor typically manages remediation server-side.
CVSS v3.1
Score 3.1low
Affected software
Spring
Spring Cloud Function
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-532) in Spring Cloud Function allows sensitive information to be logged inadvertently, potentially exposing confidential data through logs. It affects several versions of Spring Cloud Function, including 3.2.16 and earlier, 4.2.0 to 4.2.7, 4.3.0 to 4.3.4, and 5.0.0 to 5.0.3. The CVSS score is 3.1 (low severity), indicating limited impact primarily on confidentiality. The vulnerability is relevant in AWS deployments of Spring Cloud Function. Patch availability is confirmed, and as this is a cloud service, the vendor manages remediation on the server side.
Potential Impact
The impact is limited to potential exposure of sensitive information through logs, which could lead to confidentiality loss. The CVSS score of 3.1 reflects low severity with no impact on integrity or availability. There are no known exploits in the wild.
Mitigation Recommendations
A patch is available for this vulnerability. Since Spring Cloud Function is a cloud-hosted service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory for current remediation status and ensure their environments are updated accordingly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- vmware
- Date Reserved
- 2026-07-04T18:13:46.708Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6a909cf8acd9273b49b2d064
Added to database: 08/27/2026, 20:24:24 UTC
Last enriched: 09/10/2026, 04:22:56 UTC
Last updated: 10/11/2026, 06:48:17 UTC
Views: 80
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.