CVE-2026-59292 Spring CVE debrief

Who should care

Developers and administrators using Spring Integration, especially those handling sensitive data, should be aware of this vulnerability and take necessary precautions to restrict access to sensitive data and ensure proper permissions. This includes reviewing and updating Spring Integration configurations, monitoring for and applying vendor-provided patches or updates, and implementing compensating controls to mitigate the risk of sensitive data exposure.

Technical summary

The PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore in Spring Integration, persists its state to a properties file located in ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. This could potentially expose sensitive data, such as authentication credentials or encryption keys. The issue affects multiple versions of Spring Integration, including 5.5.21 and earlier, 6.4.0 - 6.4.12, 6.5.0 - 6.5.10, 7.0.0 - 7.0.5, and 7.1.0.

Defensive priority

Developers and administrators should prioritize reviewing and updating Spring Integration configurations to restrict access to sensitive data and ensure proper permissions.

Recommended defensive actions

• Review and update Spring Integration configurations to restrict access to sensitive data
• Ensure proper permissions are set for the metadata store properties file
• Monitor for and apply vendor-provided patches or updates
• Perform a thorough review of the affected systems to identify potential exposure
• Implement compensating controls to mitigate the risk of sensitive data exposure
• Track exceptions and retest remediated assets to ensure the issue is resolved
• Conduct regular security audits to detect similar vulnerabilities in the future

Evidence notes

The default file-based ConcurrentMetadataStore in Spring Integration persists its state to a properties file with world-readable permissions, potentially exposing sensitive data. This issue affects multiple versions of Spring Integration, including 5.5.21 and earlier, 6.4.0 - 6.4.12, 6.5.0 - 6.5.10, 7.0.0 - 7.0.5, and 7.1.0. Developers should verify the configuration and permissions of the metadata store properties file to ensure it is not accessible to unauthorized users.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.