Spring Cloud Function CVE-2026-59301

Exploitation requires that the target application is deployed on the Azure Functions runtime using the Spring Cloud Function Azure adapter - deployments targeting AWS Lambda, GCP, or standalone Spring Boot are not affected based on available data. The CVSS vector specifies PR:H (high-privilege attacker) and UI:R (user interaction required), meaning the sensitive data must be actively submitted during a function invocation by a privileged user, and a secondary party must then access the log store. Non-default verbose logging configuration may increase the volume of sensitive data captured. Exploitation is further limited by AC:H, implying specific conditions (invocation patterns, parameter types) must align. The attacker does not need to interact with the application directly - access to the downstream log aggregation system is the actual attack surface.

The official CVSS 3.1 score of 3.1 (Low) reflects a narrow, difficult-to-trigger exposure. The full vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N indicates that exploitation requires high-privilege access (presumably an operator or administrator role), high attack complexity (specific configuration or invocation conditions), and user interaction - a combination that dramatically limits real-world impact beyond the attacker already having elevated access. No EPSS score was provided in the intelligence package, and the CVE is absent from the CISA KEV, confirming no confirmed active exploitation. The I:L metric in the vendor vector is somewhat unusual for a logging disclosure and may reflect the risk that logged credentials could be reused for unauthorized actions, though this is an indirect integrity concern. Real-world priority is low: organizations where logs are centrally stored in a SIEM accessible by fewer parties than direct application access face negligible incremental risk. The absence of a CWE assignment suggests the vendor may still be refining the root cause taxonomy.

An operator or administrator with high-privilege access to a Spring Cloud Function Azure deployment triggers a function invocation that passes sensitive data (such as a credential, token, or PII) as a parameter. The Azure adapter logs this payload without sanitization; an attacker who subsequently gains read access to the centralized log store (e.g., Azure Monitor, Log Analytics, or an exported SIEM) retrieves the sensitive value. No public exploit code exists at time of analysis.