CVE-2026-59292lowCWE-732

CVE-2026-59292: falha de baixa gravidade em Spring Integration

World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Spring Integration

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.2epss 0.1%
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Produtos afetados
Spring · Spring Integration
CVEs relacionadas — Spring Integration

No mesmo produto, das mais perigosas para as menos.

CVE-2026-47864MEDIUMUnsafe Java deserialization in SerializingHttpMessageConverter — remote code executionEPSS 5.9%CVE-2019-3772—Spring Integration XML External Entity Injection (XXE)EPSS 3.0%CVE-2026-59274MEDIUMUnbounded decompression in UnZipTransformer enables zip-bomb DoSEPSS 0.4%CVE-2026-59307HIGHDeserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale referenceEPSS 0.4%CVE-2026-59311MEDIUMFixed predictable /tmp/ziptransformer work directory enables symlink pre-creationEPSS 0.4%CVE-2026-47861MEDIUMUDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=falseEPSS 0.3%