CVE Feed

    Dashboard / CVE / CVE-2026-59326

    CVE-2026-59326

    The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentials in the form http://user:pass@proxy:8080, and the language server writes this value to its log file without any redaction. Since language server log files are often attached to bug reports or are readable by other local users/processes, this can result in disclosure of proxy credentials. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

    Published:Jul 30, 2026
    Last Modified:Jul 30, 2026
    EPS:Jul 30, 2026
    EPSS Score:0.00095
    CVSS Score:3.3

    Affected Products

    Vendor
    Spring
    Product
    Spring Tools For Eclipse
    Vendor
    Spring
    Product
    Spring Tools For Vscode / Cursor / Theia

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-215 Fuzzing for application mapping

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High