Executive brief
Spring Cloud Function is a framework used to build serverless functions that integrate with cloud platforms like Azure. A flaw in versions 4.2.0–4.2.7, 4.3.0–4.3.4, and 5.0.0–5.0.3 can cause sensitive data (such as credentials or API keys) to be written to application logs, potentially exposing it to unauthorized users with log access.
Technical details
The vulnerability is an information disclosure issue in Spring Cloud Function's Azure integration where sensitive data may be logged without proper redaction. The root cause involves insufficient sanitization of function parameters or configuration values before they are written to log output. An attacker with access to application logs (via cloud provider dashboards, centralized logging systems, or file access) can retrieve credentials or other sensitive configuration. No special network access or authentication bypass is required beyond existing log visibility. Patches are available in versions 4.2.8+, 4.3.5+, and 5.0.4+.
Affected products
- VMware Spring Cloud Function 4.2.0 - 4.2.7, 4.3.0 - 4.3.4, 5.0.0 - 5.0.3
Timeline
- 2026-08-27: disclosed