Sensitive Credential Exposure in Spring Boot Language Server from Spring
CVE-2026-59326

3.3LOW

Key Information:

Vendor

Spring

Status
Spring Tools For Eclipse
Spring Tools For Vscode / Cursor / Theia
Vendor
CVE Published:
30 July 2026

What is CVE-2026-59326?

The Spring Boot language server logs sensitive information from the environment variables related to proxy settings without redaction. When creating an outbound HTTP client, the server outputs the raw values of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY variables at INFO level. This poses a significant risk as corporate proxy URLs may contain Basic-auth credentials, which are logged verbatim. Consequently, these log files, often included in bug reports or accessible to other local users, could lead to unintended disclosure of sensitive proxy credentials.

Affected Version(s)

Spring Tools for Eclipse 0 <= 5.2.0

Spring Tools for VSCode / Cursor / Theia 0 <= 2.2.0

References

https://spring.io/security/cve-2026-59326

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.