Executive brief
Spring Cloud Stream is a framework used to build event-driven applications that process data streams. The vulnerability allows sensitive information such as passwords or authentication tokens to be unintentionally logged in application logs, potentially exposing this data to unauthorized users with access to log files.
Technical details
This vulnerability is an information disclosure issue in Spring Cloud Stream's logging mechanism. The root cause involves improper sanitization of sensitive data before logging, allowing authentication credentials or other confidential information to be written to logs. The vulnerability is exploitable by any user or process with read access to application logs, requiring no network access or authentication to the application itself. An attacker can retrieve sensitive data from log files to compromise system accounts or escalate privileges. Patches are available in Spring Cloud Stream versions after 5.0.2, 4.3.3, and 4.2.6.
Affected products
- VMware Spring Cloud Stream 5.0.0 - 5.0.2, 4.3.0 - 4.3.3, 4.2.0 - 4.2.6
Timeline
- 2026-08-27: disclosed