Spring Integration EUVD-2026-67180

Exploitation requires the attacker to have local shell access, or equivalent file-system read access, on the host where the Spring Integration application is running. The vulnerability is present when PropertiesPersistingMetadataStore is in use - this is the default ConcurrentMetadataStore implementation, so no special non-default configuration of the application is required for exposure. The file is only created and populated when the application actually exercises ConcurrentMetadataStore functionality (e.g., idempotent receivers, resequencer, or message history components). Exploitation is strictly limited by the local attack vector: remote-only attackers cannot access the file without first obtaining local OS access. The impact is further bounded to read-only access to integration metadata - no code execution, integrity modification, or availability impact are achievable through this exposure alone.

The CVSS base score of 3.2 (Low) with vector AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N accurately characterizes this as a low-severity local disclosure issue. Exploitation requires the attacker to already have local OS access to the host - a substantial prerequisite that significantly limits real-world exposure compared to network-exploitable flaws. No EPSS score was provided, no CISA KEV listing exists, and no public exploit code has been identified at time of analysis, all consistent with low exploitation urgency. The practical data exposed - integration metadata such as idempotency keys, message offsets, or channel state - has limited direct business value compared to credentials or PII, but in sensitive pipeline environments could reveal message routing patterns or processing state. Multi-tenant or shared Linux hosts running Spring Integration as a service account represent the highest-risk deployment scenario, since unprivileged local users on such systems can trivially read the file without special tools. The Scope:Changed rating in the CVSS vector is technically accurate but should not inflate urgency - the cross-context exposure is local-only and confidentiality impact is low. This vulnerability is best treated as a routine patch-cycle item rather than an emergency response.

An unprivileged local user on a shared Linux server - such as a developer, CI agent, or co-located service account - reads /tmp/spring-integration/metadata-store.properties using a standard file read command, recovering integration metadata including message offsets, idempotency tokens, or routing keys stored by the Spring Integration application. No exploit code is publicly available and no special tools or elevated privileges are required beyond a local shell session.