CVE-2026-56100: SpringBlade Privilege Escalation Vulnerability

CVE-2026-56100 Overview

CVE-2026-56100 is a privilege escalation vulnerability in SpringBlade versions 2.7.3 up to but not including 5.0.0. Authenticated attackers can create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint. The endpoint is exposed through @RestController without authorization checks. The gateway authentication filter validates only JWT parsing and does not verify user roles or caller identity. A hardcoded JWT signing key embedded in publicly available JARs allows attackers to forge tokens. Successful exploitation enables cross-tenant data pollution and persistent backdoor access. This weakness maps to CWE-862: Missing Authorization.

Critical Impact
A low-privilege authenticated user can forge a JWT with the hardcoded signing key and invoke the internal Feign endpoint to create administrator accounts, resulting in tenant-wide compromise.

Affected Products

SpringBlade 2.7.3 and later
SpringBlade versions prior to 5.0.0
Deployments exposing the internal Feign user-creation endpoint

Discovery Timeline

2026-08-28 - CVE-2026-56100 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-56100

Vulnerability Analysis

SpringBlade uses a Spring Cloud microservice architecture with Feign clients for internal service-to-service calls. The user-creation endpoint intended for internal Feign calls is annotated with @RestController and reachable through the public gateway. No authorization check enforces caller identity or role. The gateway authentication filter parses the JWT and confirms its signature but does not evaluate the role claim or the source of the request. Any authenticated low-privilege user can therefore reach the endpoint and submit a POST request that provisions an administrator account.

Root Cause

Two defects combine to produce the escalation path. First, the internal Feign endpoint lacks authorization annotations, so the gateway forwards external requests to it without restriction. Second, the JWT signing key is hardcoded and shipped in publicly available JARs, allowing attackers to forge tokens with arbitrary claims. The gateway filter treats a valid signature as sufficient trust, which violates the principle of least privilege for internal APIs.

Attack Vector

Exploitation requires network access to the gateway and a low-privilege authenticated session, or a forged JWT signed with the extracted hardcoded key. The attacker sends a crafted POST request to the exposed Feign user-creation endpoint containing administrator role attributes. The service creates the account, granting the attacker persistent administrative access across tenants.

The following patch excerpt from the v5.0.0 release illustrates the scope of the refactor that resolves the issue:

java

 import org.springblade.common.cache.CacheNames;
 import org.springblade.core.redis.cache.BladeRedis;
 import org.springblade.core.secure.AuthInfo;
+import org.springblade.core.swagger.annotation.ApiOrder;
 import org.springblade.core.tool.api.R;
 import org.springblade.core.tool.support.Kv;
 import org.springblade.core.tool.utils.Func;

Source: SpringBlade commit c69b954

Detection Methods for CVE-2026-56100

Indicators of Compromise

Unexpected POST requests to internal Feign user-creation paths originating from external IP addresses through the gateway
Newly created accounts with administrator or role_id=1 attributes not tied to a legitimate provisioning workflow
JWT tokens presented at the gateway that were not issued by the authentication service, identifiable by mismatched issuance logs
Cross-tenant record modifications performed by accounts with recent creation timestamps

Detection Strategies

Inspect gateway access logs for POST requests targeting Feign endpoints such as user creation paths and correlate the source with expected internal service IPs
Alert on privilege changes and administrator account creation events that are not accompanied by a corresponding audit record from the admin console
Compare JWT iat and jti claims against the authentication service issuance log to identify forged tokens

Monitoring Recommendations

Enable structured audit logging for every account creation and role assignment operation
Forward gateway, authentication, and user service logs to a centralized analytics platform for correlation
Monitor for enumeration of Feign endpoints and repeated 401 or 403 responses that transition to 200 responses

How to Mitigate CVE-2026-56100

Immediate Actions Required

Upgrade SpringBlade to version 5.0.0 or later, which refactors authentication and rotates default signing material
Rotate the JWT signing key immediately and remove any hardcoded values from packaged JARs and configuration files
Restrict Feign endpoints to internal networks using network policies, service mesh authorization, or gateway path filters
Audit all administrator and elevated-role accounts created since deployment and revoke unauthorized entries

Patch Information

The vendor fix is delivered in SpringBlade v5.0.0, which refactors the platform on SpringBoot 4, SpringCloud 2025, and JDK 21. Details of the change are documented in commit c69b954 and the VulnCheck advisory. Additional exploitation context is available in the public gist for CVE-2026-56100.

Workarounds

Add authorization annotations or interceptors to every @RestController intended for internal Feign use, validating both role and caller identity
Configure the gateway to block external requests to internal service paths using explicit allow-listing
Replace the hardcoded JWT signing key with a per-deployment secret sourced from a secrets manager
Enforce role claim validation in the gateway authentication filter in addition to signature verification

bash

# Configuration example: restrict internal Feign paths at the gateway
spring:
  cloud:
    gateway:
      routes:
        - id: block-internal-feign
          uri: no://op
          predicates:
            - Path=/api/blade-user/user-info-by-id,/api/blade-user/submit
            - Header=X-Internal-Call, ^(?!true$).*
          filters:
            - SetStatus=403