What is the CVSS score of CVE-2026-52474?

CVE-2026-52474 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Java are affected by CVE-2026-52474?

A high-severity information disclosure vulnerability in aiflowy versions 2.1.2 and earlier allows unauthenticated remote extraction of application secrets and configuration data through unrestricted…

How to fix or mitigate CVE-2026-52474?

Within 24 hours, conduct a complete inventory of aiflowy deployments and verify they are not running vulnerable versions (2.1.2 or earlier). Within 7 days, implement network-level access controls to restrict aiflowy exposure to authorized internal users only, deploy request filtering rules targeting the JobUtil.java scheduling endpoint, and audit application logs for exploitation indicators or suspicious Spring bean instantiation attempts. Within 30 days, establish ongoing vendor advisory monitoring for patch availability, rotate any secrets managed or accessible by vulnerable aiflowy instances, and develop a migration plan to alternative low-code platforms if vendor remediation timelines are unacceptable.

Java CVE-2026-52474

HIGH

Information Exposure (CWE-200)

2026-07-21 mitre

Java Information Disclosure N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 17:24 vuln.today

CVSS changed

Jul 22, 2026 - 17:22 NVD

7.5 (HIGH)

CVE Published

Jul 21, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Jul 21, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.

AnalysisAI

Information disclosure in aiflowy (an open-source Java/Spring-based AI workflow / low-code platform) versions 2.1.2 and earlier lets remote unauthenticated attackers extract sensitive information through the JobUtil.java scheduling component. The public technical writeup titled 'Any SpringBean invocation' indicates the flaw stems from unrestricted invocation of arbitrary Spring beans, which can be abused to read internal application state and secrets. No CISA KEV listing and a low EPSS score (0.19%, 9th percentile) suggest no observed mass exploitation, but a public technical analysis describing the technique exists.