CVE-2026-59301: CWE-532 Insertion of Sensitive Information into Log File in Spring Spring Cloud Function

This vulnerability (CVE-2026-59301) concerns the potential logging of sensitive information within Spring Cloud Function when used in Azure environments. The affected versions include 4.2.0 to 4.2.7, 4.3.0 to 4.3.4, and 5.0.0 to 5.0.3. The CVSS score is 3.1 (low severity), with attack vector network, high attack complexity, requiring privileges and user interaction, and impacts confidentiality and integrity to a limited extent. The vulnerability is categorized under CWE-532 (Insertion of Sensitive Information into Log File). The product is a cloud-hosted service, and the vendor typically manages patching for such services. No active exploitation has been reported.

The vulnerability could lead to sensitive information being recorded in log files, potentially exposing confidential data to unauthorized viewers with access to logs. The impact is limited to confidentiality and integrity with no reported impact on availability. The low CVSS score reflects the requirement for high attack complexity, privileges, and user interaction, reducing the likelihood of exploitation.

Since Spring Cloud Function is a cloud-hosted service, the vendor manages remediation server-side. A patch is available, and users should verify with the vendor advisory for the current remediation status and ensure their environment is updated accordingly. No immediate action is required beyond applying vendor updates as they become available.