Spring Tools CVE-2026-59326

Two specific conditions must both be true for credential exposure to occur: (1) the affected user must have a proxy URL with embedded Basic-auth credentials set in one of the HTTP_PROXY, HTTPS_PROXY, http_proxy, or https_proxy environment variables, and (2) no explicit http.proxy setting must be configured at the IDE workspace level-because a workspace setting causes the language server to bypass the environment variable lookup entirely. Exploitation of the resulting log content additionally requires that a second party gain read access to the log file, either through shared local file system access (PR:L per CVSS) or through the common practice of attaching logs to bug reports. The vulnerability does NOT trigger in proxy environments using NTLM, Kerberos, or other auth schemes where credentials are not embedded in the URL string. It is also inert for users whose proxies require no authentication, or who explicitly configure the workspace proxy setting.

The vendor-assigned CVSS 3.1 base score of 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is consistent with the threat model: exploitation requires local access, low-privilege access to the log file, and the specific configuration condition where no workspace proxy setting overrides the environment variable fallback. There is no EPSS score provided, no CISA KEV listing, and no public exploit code identified, making this a low-urgency finding in absolute terms. However, the real-world risk is not trivial: in enterprise environments, proxy credentials may grant network-level access to internal resources, and log files are routinely shared in support tickets, GitHub issues, or bug reports-widening the exposure beyond a strictly local threat. The CVSS local attack vector accurately reflects that an attacker must have existing system access, but it does not capture the secondary exposure vector of log-sharing. Organizations with strict secrets management or compliance requirements (PCI-DSS, SOC 2) may assess this higher than the raw score suggests. No CVSS signal conflicts are present; the vector is internally consistent with the description.

A developer working on a corporate network has HTTP_PROXY set to http://jdoe:s3cr3t@proxy.corp.example.com:8080 in their environment. They open a Spring project in VS Code with no workspace proxy setting configured. The Spring Tools language server starts, makes an outbound HTTP request, and logs the full proxy URL at INFO level to the language server log. The developer later files a GitHub issue reproducing a build problem and attaches the log-publicly exposing jdoe's proxy credentials to anyone who views the issue. No exploit code is needed; the log contents are the artifact of exploitation.