CVE-2026-47878 Overview
CVE-2026-47878 is an insecure deserialization vulnerability in Spring Batch's DefaultExecutionContextSerializer. The serializer is used by default in the JDBC job repository. It passes Base64-decoded bytes directly to ObjectInputStream.readObject() without applying an ObjectInputFilter that restricts types to a trusted class allowlist. An attacker who can influence the serialized execution context stored in the job repository could trigger unsafe object deserialization when the context is read back. Spring Batch versions 6.0.0 through 6.0.4 and 5.2.6 and earlier are affected.
Critical Impact
Untrusted data reaching ObjectInputStream.readObject() may lead to arbitrary object instantiation and gadget-chain execution within the Spring Batch runtime.
Affected Products
- Spring Batch 6.0.0 – 6.0.4
- Spring Batch 5.2.6 and earlier
- Applications using the default JDBC job repository with DefaultExecutionContextSerializer
Discovery Timeline
- 2026-08-27 - CVE-2026-47878 published to NVD
- 2026-08-27 - Last updated in NVD database
- Reference: Spring Security Advisory CVE-2026-47878
Technical Details for CVE-2026-47878
Vulnerability Analysis
Spring Batch persists job ExecutionContext data through the JDBC job repository. The DefaultExecutionContextSerializer serializes Java objects with ObjectOutputStream and later deserializes them with ObjectInputStream.readObject(). The deserialization path does not install an ObjectInputFilter restricting the allowed classes. Any attacker able to write into the underlying batch tables, or otherwise influence the Base64-encoded payload, can supply a crafted serialized graph. When Spring Batch reads the context, the JVM instantiates attacker-controlled classes and invokes their readObject and related lifecycle methods. Java deserialization gadget chains from libraries on the classpath can then drive arbitrary behavior inside the batch process. This maps to [CWE-502] Deserialization of Untrusted Data.
Root Cause
The root cause is missing type filtering on ObjectInputStream. DefaultExecutionContextSerializer trusts the persisted bytes because they originated from the same application. That assumption breaks when database access, backups, replicas, or upstream services can be manipulated by an attacker.
Attack Vector
Exploitation requires the ability to modify the serialized ExecutionContext bytes stored in the Spring Batch metadata tables. Common preconditions include SQL injection into the batch schema, compromised database credentials, or a shared repository accessed by lower-trust producers. Attack complexity is high because the attacker must place a valid gadget chain payload and wait for the job to resume or restart. See the Spring Security Advisory CVE-2026-47878 for vendor guidance.
No verified proof-of-concept code is published. The vulnerability mechanism follows the standard Java deserialization pattern: crafted serialized bytes reach ObjectInputStream.readObject() without class allowlisting, allowing gadget chains present on the classpath to execute during object graph reconstruction.
Detection Methods for CVE-2026-47878
Indicators of Compromise
- Unexpected writes or updates to BATCH_STEP_EXECUTION_CONTEXT and BATCH_JOB_EXECUTION_CONTEXT tables from non-application accounts.
- Base64 payloads in SERIALIZED_CONTEXT columns whose decoded bytes begin with the Java serialization magic 0xAC 0xED 0x00 0x05 and contain gadget class names such as CommonsCollections, Rome, or Spring abuse patterns.
- Java process spawning shell, scripting, or network utilities from a Spring Batch worker after a job restart.
Detection Strategies
- Monitor JVM child-process creation from Spring Batch application processes and alert on shell, curl, wget, or reflection-driven class loads.
- Enable Java Flight Recorder or agent-based instrumentation to log ObjectInputStream.readObject invocations that resolve non-allowlisted classes.
- Correlate database write activity on batch metadata tables with the identity of the connecting principal.
Monitoring Recommendations
- Ingest application, database, and host telemetry into a central data lake and hunt for anomalous batch-job restart patterns.
- Alert on new classes appearing in deserialization stack traces within Spring Batch worker logs.
- Track outbound connections from batch hosts to unexpected destinations following job resumption.
How to Mitigate CVE-2026-47878
Immediate Actions Required
- Upgrade Spring Batch to a fixed release as published in the Spring Security Advisory CVE-2026-47878.
- Restrict database credentials used by the Spring Batch job repository to the minimum required grants and block direct write access from other services.
- Audit the BATCH_* tables for unexpected modifications to serialized context columns.
Patch Information
Spring has released fixed versions addressing the missing ObjectInputFilter. Consult the Spring Security Advisory CVE-2026-47878 for the exact fixed versions and upgrade notes for the 5.x and 6.x branches.
Workarounds
- Replace DefaultExecutionContextSerializer with a serializer that uses a JSON or type-restricted format such as Jackson2ExecutionContextStringSerializer.
- Configure a JVM-wide deserialization filter using -Djdk.serialFilter that allowlists only the classes Spring Batch requires.
- Isolate the Spring Batch metadata database on a dedicated schema with network and identity controls that prevent untrusted writers.
# Configuration example: JVM-wide deserialization allowlist
java -Djdk.serialFilter='java.lang.*;java.util.*;org.springframework.batch.**;!*' \
-jar spring-batch-app.jar
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
