Spring Cloud: 17 Vulnerabilities Disclosed Across Multiple Components, Ranging High to Low Severity
A batch of 17 vulnerabilities affecting Spring Cloud Config, Stream, Function, Commons, Gateway, and Data JPA was disclosed, with severities ranging from Low to High.
Key findings
- 17 CVEs disclosed across Spring Cloud components between August 26-27, 2026.
- Vulnerabilities include DoS, deserialization, SSRF, arbitrary file read, and improper authentication.
- High severity flaws found in Spring Cloud Config, Gateway, and Commons.
- Affected versions span multiple release lines; consult advisories for specific details.
- Patches are available; prompt updates are recommended for all affected Spring Cloud deployments.
On August 26th and 27th, 2026, a batch of 17 vulnerabilities was disclosed across multiple Spring Cloud components, including Spring Cloud Config, Spring Cloud Stream, Spring Cloud Function, Spring Cloud Commons, Spring Cloud Gateway, and Spring Data JPA. The vulnerabilities range in severity from Low to High, with the most critical issues potentially allowing for arbitrary file reads, Server-Side Request Forgery (SSRF), and unauthorized access to sensitive system information.
Several vulnerabilities were identified in Spring Cloud Stream, primarily related to deserialization of untrusted types (CVE-2026-59306), improper caching of content types (CVE-2026-59304), and dynamic cache size binding (CVE-2026-59303). Additionally, potential logging of sensitive data was noted in Spring Cloud Stream (CVE-2026-59302) and Spring Cloud Function for Azure and AWS (CVE-2026-59301, CVE-2026-59300). Spring Cloud Function also faces issues with composition lookup poisoning (CVE-2026-59299), improper HTTP header filtering (CVE-2026-59298), and a flawed isSecure() implementation (CVE-2026-59297). A significant vulnerability in Spring Cloud Function (CVE-2026-59291) allows for arbitrary file reads and SSRF.
Spring Cloud Config is affected by a Denial of Service vulnerability (CVE-2026-59315) and a critical missing authentication flaw in its monitor endpoint (CVE-2026-47837), which was disclosed on August 26th. The latter allows unvalidated webhook requests to the /monitor endpoint. Another critical vulnerability in Spring Cloud Config (CVE-2026-47836), also disclosed on August 26th, involves a Time-of-Check-Time-of-Use (TOCTOU) attack against the base directory used for cloning SVN repositories.
Further impacting the ecosystem, Spring Cloud Commons has a high-severity vulnerability (CVE-2026-59284) due to a lack of allow-listing for property keys when the /actuator/env endpoint is enabled, potentially leading to unauthorized modifications. Spring Cloud Gateway suffers from a vulnerability (CVE-2026-47879) allowing arbitrary Spring Resource locations for defining the proto descriptor. Lastly, Spring Data JPA has a medium-severity bypass vulnerability in its Sort validation (CVE-2026-47834) when accepting crafted payloads from untrusted sources.
The affected versions span multiple release lines for each component, with patches available in specific updated versions. Users are strongly advised to consult the official Spring Security advisories for detailed version information and apply the necessary updates to mitigate these risks. The broad range of affected components and the mix of severity levels underscore the importance of a comprehensive review and update strategy for Spring Cloud deployments.
The disclosure of these vulnerabilities highlights the ongoing need for vigilance in securing complex Java-based application frameworks. While many of the issues are low severity, the presence of multiple high-severity flaws, particularly in critical components like Spring Cloud Config and Gateway, warrants immediate attention from administrators and developers. Applying patches promptly is crucial to prevent potential exploitation and maintain the integrity and security of applications built with Spring Cloud. The coordinated disclosure across multiple components suggests a focused effort by the security researchers or the vendor to address a cluster of related issues.