Spring Cloud Function CVE-2026-59291

Exploitation requires that the attacker already holds high-level privileges within the Spring Cloud Function application (PR:H per CVSS vector) - this limits the realistic attacker population to insiders, compromised admin accounts, or lateral movers with prior high-privilege access. Additionally, user interaction must occur (UI:R), meaning the attack cannot be fully automated and requires a separate action by another user or a timing-dependent triggering event. High attack complexity (AC:H) further indicates that specific environmental conditions, non-default configuration states, or precise request timing must align; the exact triggering configuration or feature is not disclosed in the available advisory text. The CVSS C:N rating formally limits confidentiality impact, though this conflicts with the 'arbitrary file read' description - the actual file read may be conditional on a specific non-default deployment mode or path constraint. Exploitation is not possible against default-configured instances where the vulnerable feature or code path is inactive.

The real-world risk of this vulnerability is low despite the concerning label. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N encodes four independent limiting conditions: the attacker must already hold high-level privileges (PR:H), a separate user interaction must occur (UI:R), attack complexity is high (AC:H) indicating specific environmental or timing conditions, and the only confirmed impact is low integrity (I:L). Critically, the C:N (no confidentiality impact) rating is in tension with the description's explicit mention of 'arbitrary file read' - file read primitives almost universally imply at least C:L. This discrepancy should be verified against the full vendor advisory, as the description may overstate or the CVSS may understate the confidentiality exposure. No EPSS score was provided. The vulnerability is not listed in the CISA KEV catalog and no POC code has been identified, confirming this is not an actively exploited issue. Overall, this is a low-priority finding except for organizations with strict compliance postures requiring patching of all vendor-disclosed vulnerabilities.

An attacker already holding high-privilege credentials to a vulnerable Spring Cloud Function deployment crafts a malicious input to a function endpoint that, under specific high-complexity conditions, causes the server to read a local file or issue an HTTP request to an internal resource. The attacker must also wait for or induce a required user interaction event as part of the attack sequence. No public exploit code exists to automate or demonstrate this chain.