Executive brief
Spring Integration, a framework for building enterprise messaging applications, stores sensitive metadata in a world-readable temporary file. An attacker on the same system could read this file to obtain sensitive information used by the application, potentially compromising authentication tokens, connection strings, or other configuration data stored in the metadata.
Technical details
The PropertiesPersistingMetadataStore class, which is the default file-based ConcurrentMetadataStore implementation in Spring Integration, persists application state to a properties file at ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. This is a local information disclosure vulnerability accessible only to users on the same system with read access to the temporary directory. The vulnerability affects Spring Integration 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, and 7.0.0 through 7.0.5; version 7.1.0 and later have fixed the issue by restricting file permissions.
Affected products
- VMware Spring Integration 5.5.21 and earlier, 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5
Timeline
- 2026-08-27: disclosed