CVE-2026-59302: CWE-532 Insertion of Sensitive Information into Log File in Spring Spring Cloud Stream

This vulnerability (CVE-2026-59302) concerns the insertion of sensitive information into log files within Spring Cloud Stream versions 4.2.0 to 4.2.6, 4.3.0 to 4.3.3, and 5.0.0 to 5.0.2. The issue is categorized as CWE-532, indicating improper handling of sensitive data in logs. The CVSS 3.1 base score is 3.1, reflecting a low severity impact with network attack vector, high attack complexity, required privileges, and user interaction. There is no vendor advisory or patch information available at this time.

The vulnerability may lead to sensitive data being logged and potentially exposed to unauthorized parties with access to log files. The impact is rated low severity with limited confidentiality and integrity impact, and no availability impact. Exploitation requires high privileges and user interaction, reducing the likelihood of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review logging configurations and avoid logging sensitive information where possible. Monitor vendor communications for updates on patches or mitigations.