SpringBlade CVE-2026-56100

Exploitation requires an existing low-privilege user account on the target SpringBlade instance to obtain an initial JWT. No special or non-default configuration is required for the vulnerable endpoint to be accessible - the Feign user-creation API is exposed via @RestController and routed through the gateway in default deployments of versions 2.7.3 through 3.5.0. The hardcoded JWT signing key distributed in public JARs eliminates any practical key-extraction barrier. Network access to the SpringBlade gateway is required; direct access to backend microservice ports is not. Exploitation is bounded by version: v5.0.0 and later are patched. The absence of role or caller-identity validation in the gateway filter means no elevated privileges are needed beyond initial account existence to escalate to full system administrator.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) is consistent with the described attack mechanics, though the PR:L rating may overstate the barrier: the hardcoded JWT signing key, distributed publicly in JAR files, effectively collapses the real-world access requirement to near-zero for anyone who can download the application. EPSS data was not provided, but the combination of a low-complexity network attack path and a publicly available POC gist places this in a category that warrants urgent triage regardless of EPSS percentile. There is no CISA KEV listing, so confirmed active exploitation in the wild has not been established - but the low exploitation bar means opportunistic scanning is a credible near-term threat. The cross-tenant data pollution impact and ability to plant persistent backdoor admin accounts amplify business risk well beyond a single-tenant compromise scenario. The provided commit diff shows only Swagger annotation changes and does not independently verify that the patch addresses the authorization logic - defenders should confirm the fix scope against the full v5.0.0 release before treating remediation as complete.

An attacker registers or compromises a low-privilege SpringBlade account to obtain a valid JWT, then downloads the publicly available SpringBlade JAR and extracts the hardcoded signing key. Using the extracted key, the attacker forges a JWT asserting system administrator privileges and sends a crafted POST request to the unprotected Feign user-creation endpoint through the gateway, successfully registering a new admin-level backdoor account. A working POC demonstrating this flow is publicly available at https://gist.github.com/sud0why/e73405057dd7414a8c221ef17e0d0059.