EUVD-2026-50979
GHSA-9j65-vr9q-w452
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local vector confirmed by log-file access model; PR:L because a standard local user account is sufficient; C:L because only proxy credentials are exposed, not broader system confidentiality.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentials in the form http://user:pass@proxy:8080, and the language server writes this value to its log file without any redaction. Since language server log files are often attached to bug reports or are readable by other local users/processes, this can result in disclosure of proxy credentials. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier
AnalysisAI
Spring Tools language server exposes proxy Basic-auth credentials in cleartext log files, affecting Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode/Cursor/Theia 2.2.0 and earlier. When no explicit http.proxy workspace setting is configured, the language server reads the HTTP_PROXY/HTTPS_PROXY (and lowercase variants) environment variables and writes their raw values-including embedded credentials in the form http://user:pass@proxy:8080-to its log at INFO level without redaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be true for credential exposure to occur: (1) the affected user must have a proxy URL with embedded Basic-auth credentials set in one of the HTTP_PROXY, HTTPS_PROXY, http_proxy, or https_proxy environment variables, and (2) no explicit http.proxy setting must be configured at the IDE workspace level-because a workspace setting causes the language server to bypass the environment variable lookup entirely. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 base score of 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is consistent with the threat model: exploitation requires local access, low-privilege access to the log file, and the specific configuration condition where no workspace proxy setting overrides the environment variable fallback. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A developer working on a corporate network has HTTP_PROXY set to http://jdoe:s3cr3t@proxy.corp.example.com:8080 in their environment. They open a Spring project in VS Code with no workspace proxy setting configured. … |
| Remediation | Consult the official Spring security advisory at https://spring.io/security/cve-2026-59326 for confirmed fixed versions and upgrade Spring Tools for Eclipse beyond 5.2.0 and Spring Tools for VSCode/Cursor/Theia beyond 2.2.0 as soon as vendor-released patched builds are available; exact fix versions are not independently confirmed in the data available at time of this analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today