Executive brief
Spring Security is a framework used to secure Java-based applications. A vulnerability in its SAML2 service provider component could allow an attacker with administrative database access to execute malicious code. By tampering with specific database tables used for identity management, an attacker could compromise the integrity and availability of the application.
Technical details
A deserialization vulnerability exists in the JdbcAssertingPartyMetadataRepository component of Spring Security's SAML2 Service Provider. The root cause is the unsafe deserialization of data retrieved from the 'saml2_asserting_party_metadata' database table, specifically within the 'verification_credentials' and 'encryption_credentials' columns. An attacker with write permissions to these database tables can inject malicious serialized Java objects. When the application subsequently retrieves and deserializes this data, it could lead to remote code execution or other integrity impacts. This vulnerability is mitigated by the requirement for high-privileged database access and a complex attack configuration. Users should upgrade to Spring Security 7.0.6 or later.
Affected products
- VMware Spring Security 7.0.0 to 7.0.5
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-08-12: patched: GitHub advisory updated with patch information