Is CVE-2026-59326 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59326 being exploited in the wild.

How severe is CVE-2026-59326?

Low severity, with a CVSS score of 3.3, published 30 July 2026.

Which products and versions are affected?

Broadcom Spring Tools for Eclipse 5.2.0 and earlier; Broadcom Spring Tools for VSCode / Cursor / Theia 2.2.0 and earlier.

Is there a fix for CVE-2026-59326?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-59326 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-59326?

Check whether you run Broadcom Spring Tools for Eclipse or Broadcom Spring Tools for VSCode / Cursor / Theia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59326: Spring Boot language server credential disclosure in proxy logs

CVE-2026-59326 · Severity: low · CVSS 3.3 · Published 2026-07-30

The Spring Boot language server, a tool used by developers in code editors like Eclipse and VS Code, may inadvertently record sensitive proxy credentials in its log files. If a developer uses a corporate proxy that requires a username and password, these details are written in plain text to logs that are often shared in bug reports or accessible to other users on the same computer. This could allow an unauthorized person to obtain the developer's network credentials.

Technologies: Broadcom Spring Tools for Eclipse. Vendors: Broadcom.

Quick answers

Is CVE-2026-59326 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59326 being exploited in the wild.
How severe is CVE-2026-59326?: Low severity, with a CVSS score of 3.3, published 30 July 2026.
Which products and versions are affected?: Broadcom Spring Tools for Eclipse 5.2.0 and earlier; Broadcom Spring Tools for VSCode / Cursor / Theia 2.2.0 and earlier.
Is there a fix for CVE-2026-59326?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59326 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-59326?: Check whether you run Broadcom Spring Tools for Eclipse or Broadcom Spring Tools for VSCode / Cursor / Theia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Spring Boot language server is vulnerable to information disclosure because it logs the raw values of proxy environment variables (http_proxy, https_proxy, etc.) at the INFO level. This occurs when an outbound HTTP client is created and no explicit workspace proxy setting is configured. If these environment variables contain Basic-auth credentials (e.g., http://user:pass@proxy:8080), they are written to log files without redaction. An attacker with local access to the log files, or who obtains logs attached to public bug reports, can extract these credentials. The vulnerability affects Spring Tools for Eclipse (<= 5.2.0) and Spring Tools for VSCode/Cursor/Theia (<= 2.2.0).

Affected products

Spring Spring Tools for Eclipse 5.2.0 and earlier
Spring Spring Tools for VSCode / Cursor / Theia 2.2.0 and earlier

Timeline

2026-07-30: advisory
2026-07-30: disclosed

References

https://spring.io/security/cve-2026-59326

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.