TI-2026-42456 Aliases CVE-2026-59326 GHSA-9j65-vr9q-w452

HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server

LOW 15CWE-532Published 2026-07-30 · Updated 2026-07-30

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentials in the form http://user:pass@proxy:8080, and the language server writes this value to its log file without any redaction. Since language server log files are often attached to bug reports or are readable by other local users/processes, this can result in disclosure of proxy credentials. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00136 3rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VMware	Spring Tools for Eclipse	up to 5.2.0	—	No fix listed	CNA
VMware	Spring Tools for VSCode / Cursor / Theia	up to 2.2.0	—	No fix listed	CNA

Spring Tools for Eclipse VendorVMware Affected up to 5.2.0 Fixed in — No fix listed CNA
Spring Tools for VSCode / Cursor / Theia VendorVMware Affected up to 2.2.0 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:broadcom:spring_tools::::::cursor::*	before 2.3.0	Vulnerable	Broadcom
cpe:2.3:a:broadcom:spring_tools::::::theia::*	before 2.3.0	Vulnerable	Broadcom
cpe:2.3:a:broadcom:spring_tools::::::visual_studio_code::*	before 2.3.0	Vulnerable	Broadcom
cpe:2.3:a:broadcom:spring_tools::::::eclipse::*	before 5.3.0	Vulnerable	Broadcom

cpe:2.3:a:broadcom:spring_tools:*:*:*:*:*:cursor:*:* Versions before 2.3.0 Vulnerable ·Broadcom
cpe:2.3:a:broadcom:spring_tools:*:*:*:*:*:theia:*:* Versions before 2.3.0 Vulnerable ·Broadcom
cpe:2.3:a:broadcom:spring_tools:*:*:*:*:*:visual_studio_code:*:* Versions before 2.3.0 Vulnerable ·Broadcom
cpe:2.3:a:broadcom:spring_tools:*:*:*:*:*:eclipse:*:* Versions before 5.3.0 Vulnerable ·Broadcom

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-59326
2026-10-03 Alias added: GHSA-9j65-vr9q-w452

References

Advisory 1

https://spring.io/security/cve-2026-59326

TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8

See all 1181 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences