# CVE-2026-59302: Spring Cloud Stream information disclosure via logging

Source: https://junglewise.ai/threats/cve-2026-59302-spring-cloud-stream-information-disclosure-via-logging  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-59302 · Severity: low · CVSS 3.1 · Published 2026-08-27

Spring Cloud Stream is a framework used to build event-driven applications that process data streams. The vulnerability allows sensitive information such as passwords or authentication tokens to be unintentionally logged in application logs, potentially exposing this data to unauthorized users with access to log files.

Technologies: [VMware Spring Cloud Stream](https://junglewise.ai/threats/technologies/spring-cloud-stream). Vendors: [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-59302 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59302 being exploited in the wild.

**How severe is CVE-2026-59302?** Low severity, with a CVSS score of 3.1, published 27 August 2026.

**Which products and versions are affected?** VMware Spring Cloud Stream 5.0.0 - 5.0.2, 4.3.0 - 4.3.3, 4.2.0 - 4.2.6.

**Is there a fix for CVE-2026-59302?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59302 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-59302?** Check whether you run VMware Spring Cloud Stream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an information disclosure issue in Spring Cloud Stream's logging mechanism. The root cause involves improper sanitization of sensitive data before logging, allowing authentication credentials or other confidential information to be written to logs. The vulnerability is exploitable by any user or process with read access to application logs, requiring no network access or authentication to the application itself. An attacker can retrieve sensitive data from log files to compromise system accounts or escalate privileges. Patches are available in Spring Cloud Stream versions after 5.0.2, 4.3.3, and 4.2.6.

## Affected products

- VMware Spring Cloud Stream 5.0.0 - 5.0.2, 4.3.0 - 4.3.3, 4.2.0 - 4.2.6

## Timeline

- 2026-08-27: disclosed

## References

- [https://spring.io/security/cve-2026-59302](https://spring.io/security/cve-2026-59302)

## Related threats

- [Spring Cloud Stream partition interceptor improper message handling](https://junglewise.ai/threats/cve-2026-59305-spring-cloud-stream-partition-interceptor-improper-message)
- [VMware Spring Cloud Stream improper content type caching in Avro](https://junglewise.ai/threats/cve-2026-59304-vmware-spring-cloud-stream-improper-content-type-caching-in-avro)