CVE-2026-59326: Spring Boot Credential Disclosure Flaw

CVE-2026-59326 Overview

CVE-2026-59326 is an information disclosure vulnerability in the Spring Boot language server. The language server logs the raw value of the https_proxy, HTTPS_PROXY, http_proxy, and HTTP_PROXY environment variables at INFO level whenever it creates an outbound HTTP client without an explicit http.proxy workspace setting. Corporate proxy URLs frequently embed Basic authentication credentials in the form http://user:pass@proxy:8080. The language server writes these values to its log file without redaction, exposing proxy credentials to anyone with access to the log.

Critical Impact
Basic-auth credentials embedded in proxy URLs are written to language server log files in cleartext, enabling credential disclosure to local users or through shared bug reports.

Affected Products

Spring Tools for Eclipse: 5.2.0 and earlier
Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier
Spring Boot language server component

Discovery Timeline

2026-07-30 - CVE-2026-59326 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-59326

Vulnerability Analysis

The Spring Boot language server is a background process invoked by IDE integrations to provide code completion, diagnostics, and other language features for Spring Boot projects. When the server initializes an outbound HTTP client, it inspects the process environment for standard proxy configuration variables. If no explicit http.proxy workspace setting overrides them, the server logs the discovered value at INFO level to record its network configuration.

The logging call captures the raw environment variable string. Proxy URLs commonly include Basic authentication credentials directly in the URL userinfo component. The result is that usernames and passwords for corporate proxy infrastructure land in persistent log files on developer workstations.

Root Cause

The root cause is missing sanitization of sensitive URL components before logging. The language server treats the proxy URL as opaque configuration data rather than as a value that can contain secrets. No redaction of the userinfo portion (user:pass@) occurs, and INFO level ensures the entry is written under default logging configurations. This is an Information Exposure weakness related to insertion of sensitive information into log files.

Attack Vector

Exploitation requires local access to the log file or a copy of it. Two realistic scenarios exist. First, developers frequently attach language server logs to bug reports filed against Spring Tools or third-party extensions, unintentionally publishing proxy credentials to public issue trackers. Second, on multi-user workstations or shared build hosts, other local users or processes with read access to the log directory can harvest the credentials.

The attacker does not interact with the language server directly. Disclosure occurs passively as a consequence of normal IDE operation whenever a proxy environment variable containing credentials is set.

No exploitation code is required. See the Spring Security Advisory CVE-2026-59326 for vendor-provided technical details.

Detection Methods for CVE-2026-59326

Indicators of Compromise

Spring Tools language server log files containing strings matching http(s)?://[^:]+:[^@]+@ in proxy configuration entries
Log lines at INFO level referencing https_proxy, HTTPS_PROXY, http_proxy, or HTTP_PROXY with embedded userinfo
Bug reports, gist uploads, or attachments containing Spring language server logs with proxy URLs

Detection Strategies

Scan developer workstation log directories for Spring Tools language server logs and grep for authenticated proxy URL patterns
Add data loss prevention rules that inspect outbound attachments and paste operations to public issue trackers for credential-bearing URLs
Review source control and shared file locations for accidentally committed language server log files

Monitoring Recommendations

Monitor for unexpected read access to IDE and language server log directories by non-owner processes
Alert on proxy authentication failures that could indicate credential reuse following disclosure
Track versions of Spring Tools for Eclipse and Spring Tools for VSCode across engineering endpoints to identify unpatched installations

How to Mitigate CVE-2026-59326

Immediate Actions Required

Upgrade Spring Tools for Eclipse to a version later than 5.2.0 and Spring Tools for VSCode / Cursor / Theia to a version later than 2.2.0 per the Spring Security Advisory
Rotate any proxy credentials that may have appeared in language server logs, especially where logs were attached to bug reports
Purge existing Spring Tools language server log files from developer workstations after review

Patch Information

Refer to the Spring Security Advisory CVE-2026-59326 for the fixed release versions and upgrade instructions for Spring Tools for Eclipse and Spring Tools for VSCode / Cursor / Theia.

Workarounds

Configure an explicit http.proxy workspace setting in the IDE so the language server does not read the environment variable path that triggers logging
Remove credentials from http_proxy and https_proxy environment variables and use a local authenticating proxy (for example, cntlm) that holds the secret out of band
Restrict filesystem permissions on IDE log directories so only the owning user can read them
Establish a pre-submission checklist that scrubs proxy URLs from any log file before attaching it to a bug report

bash

# Example: replace credential-bearing proxy env var with a local proxy
unset http_proxy HTTP_PROXY https_proxy HTTPS_PROXY
export http_proxy=http://127.0.0.1:3128
export https_proxy=http://127.0.0.1:3128
# cntlm or a similar local proxy handles authentication upstream