CVE-2026-59326 is a vulnerability in Spring Tools for Eclipse (<=5.2.0) where the Spring Boot language server logs the raw values of https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variables at INFO level when creating outbound HTTP clients without explicit proxy settings. These environment variables often contain proxy URLs with embedded Basic-auth credentials (http://user:pass@proxy:8080). The language server writes these credentials to log files without redaction, risking credential disclosure through log file access or sharing. The vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File). There is no vendor advisory or patch currently available.

The vulnerability can lead to disclosure of proxy credentials embedded in environment variables via log files. This may allow unauthorized local users or recipients of bug reports containing logs to obtain sensitive proxy authentication information. The CVSS score of 3.3 reflects low severity, indicating limited impact confined to confidentiality of proxy credentials. There is no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using proxy environment variables with embedded credentials or ensure that log files are protected from unauthorized access. Consider configuring explicit http.proxy workspace settings to prevent the language server from logging these environment variables.