Executive brief
The Spring Boot language server, a tool used by developers in code editors like Eclipse and VS Code, may inadvertently record sensitive proxy credentials in its log files. If a developer uses a corporate proxy that requires a username and password, these details are written in plain text to logs that are often shared in bug reports or accessible to other users on the same computer. This could allow an unauthorized person to obtain the developer's network credentials.
Technical details
The Spring Boot language server is vulnerable to information disclosure because it logs the raw values of proxy environment variables (http_proxy, https_proxy, etc.) at the INFO level. This occurs when an outbound HTTP client is created and no explicit workspace proxy setting is configured. If these environment variables contain Basic-auth credentials (e.g., http://user:pass@proxy:8080), they are written to log files without redaction. An attacker with local access to the log files, or who obtains logs attached to public bug reports, can extract these credentials. The vulnerability affects Spring Tools for Eclipse (<= 5.2.0) and Spring Tools for VSCode/Cursor/Theia (<= 2.2.0).
Affected products
- Spring Spring Tools for Eclipse 5.2.0 and earlier
- Spring Spring Tools for VSCode / Cursor / Theia 2.2.0 and earlier
Timeline
- 2026-07-30: advisory
- 2026-07-30: disclosed