What is the CVSS score of EUVD-2026-50979?

EUVD-2026-50979 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Spring Tools EUVD-2026-50979

| CVE-2026-59326 LOW

Insertion of Sensitive Information into Log File (CWE-532)

2026-07-30 vmware

GHSA-9j65-vr9q-w452

Java Information Disclosure Spring Spring Tools For Eclipse Spring Tools For Vscode Cursor Theia

3.3

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.3 LOW

Local vector confirmed by log-file access model; PR:L because a standard local user account is sufficient; C:L because only proxy credentials are exposed, not broader system confidentiality.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:59 vuln.today

DescriptionCVE.org

The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentials in the form http://user:pass@proxy:8080, and the language server writes this value to its log file without any redaction. Since language server log files are often attached to bug reports or are readable by other local users/processes, this can result in disclosure of proxy credentials. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

AnalysisAI

Spring Tools language server exposes proxy Basic-auth credentials in cleartext log files, affecting Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode/Cursor/Theia 2.2.0 and earlier. When no explicit http.proxy workspace setting is configured, the language server reads the HTTP_PROXY/HTTPS_PROXY (and lowercase variants) environment variables and writes their raw values-including embedded credentials in the form http://user:pass@proxy:8080-to its log at INFO level without redaction. Because language server logs are often shared in bug reports or are readable by other local users and processes, this results in proxy credential disclosure. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.

Technical ContextAI

Spring Tools (formerly Spring Tool Suite) is a set of language server extensions and plugins that provide Spring Framework development support inside Eclipse, VS Code, Cursor, and Theia IDEs. Language servers run as background processes and communicate with IDEs via the Language Server Protocol (LSP). When the language server needs to make outbound HTTP calls (e.g., to fetch metadata or resolve dependencies), it performs a runtime check: if no workspace-level http.proxy setting is present, it falls back to reading OS-level proxy environment variables (HTTP_PROXY, HTTPS_PROXY, http_proxy, https_proxy). The raw string value-which corporate environments routinely encode as http://username:password@proxyhost:port-is then emitted at INFO log verbosity. INFO is a default-enabled log level, meaning this behavior is active in standard deployments with no special debug configuration required. Although no CWE is formally assigned in the NVD entry, this is substantively CWE-532 (Insertion of Sensitive Information into Log File). Affected CPEs confirmed by vendor: cpe:2.3:a:spring:spring_tools_for_eclipse:*:*:*:*:*:*:*:* (≤5.2.0) and cpe:2.3:a:spring:spring_tools_for_vscode_/_cursor_/_theia:*:*:*:*:*:*:*:* (≤2.2.0).

RemediationAI

Consult the official Spring security advisory at https://spring.io/security/cve-2026-59326 for confirmed fixed versions and upgrade Spring Tools for Eclipse beyond 5.2.0 and Spring Tools for VSCode/Cursor/Theia beyond 2.2.0 as soon as vendor-released patched builds are available; exact fix versions are not independently confirmed in the data available at time of this analysis. As an immediate workaround, configure an explicit http.proxy workspace setting within the IDE rather than relying on environment variable fallback-this prevents the language server from reading and logging the raw environment variable value. Alternatively, avoid embedding credentials directly in proxy environment variables by using proxy configurations that rely on OS-level credential stores or NTLM/Kerberos authentication where the URL itself contains no embedded secret. If neither workaround is feasible, restrict read permissions on language server log files to the owning user only (chmod 600 on Linux/macOS) and establish a policy against attaching raw log files to bug reports without credential scrubbing.