DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
VMware Tanzu Spring Cloud: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-08-20
Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Cloud ausnutzen, um Dateien zu manipulieren, um Informationen offenzulegen und um Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (17)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-59315US | — | — | ||
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads.
Spring Cloud Config 5.0.0 - 5.0.4
Spring Cloud Config 4.3.0 - 4.3.4
Spring Cloud… | ||||
| CVE-2026-59306US | low3.8 | — | ||
Potential for deserialization of untrusted types in Spring Cloud Stream.
Spring Cloud Stream 5.0.0 - 5.0.2
Spring Cloud Stream 4.3.0 - 4.3.3
Spring Cloud Stream 4.2.0 - 4.2.6 | ||||
| CVE-2026-59305US | low3.8 | — | ||
Partition interceptor may be improperly added while sending message.
Spring Cloud Stream 5.0.0 - 5.0.2
Spring Cloud Stream 4.3.0 - 4.3.3
Spring Cloud Stream 4.2.0 - 4.2.6 | ||||
| CVE-2026-59304US | low3.8 | — | ||
Improper caching of the original content type in Spring Cloud Stream Avro.
Spring Cloud Stream 5.0.0 - 5.0.2
Spring Cloud Stream 4.3.0 - 4.3.3
Spring Cloud Stream 4.2.0 - 4.2.6 | ||||
| CVE-2026-59303US | low3.8 | — | ||
Dynamic destination cache size is not properly bound in Spring Cloud Stream.
Spring Cloud Stream 5.0.0 - 5.0.2
Spring Cloud Stream 4.3.0 - 4.3.3
Spring Cloud Stream 4.2.0 - 4.2.6 | ||||
| CVE-2026-59302US | medium4.9 | — | ||
Potential for logging sensitive data in Spring Cloud Stream.
Spring Cloud Stream 5.0.0 - 5.0.2
Spring Cloud Stream 4.3.0 - 4.3.3
Spring Cloud Stream 4.2.0 - 4.2.6 | ||||
| CVE-2026-59301US | medium4.9 | — | ||
Potential for logging sensitive data in Spring Cloud Function Azure.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring Cloud Function 4.2.0 - 4.2.7 | ||||
| CVE-2026-59300US | low3.5 | — | ||
Potential for logging sensitive data in Spring Cloud Function AWS.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring Cloud Function 4.2.0 - 4.2.7
Sprin… | ||||
| CVE-2026-59299US | low3.5 | — | ||
Composition lookup can potentially poison base function in Spring Cloud Function.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring Cloud Function 4.2.… | ||||
| CVE-2026-59298US | low3.5 | — | ||
Potential for improper filtering of HTTP headers in Spring Cloud Function.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring Cloud Function 4.2.0 - 4.2… | ||||
| CVE-2026-59297US | low3.5 | — | ||
Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring… | ||||
| CVE-2026-59291US | medium5.5 | — | ||
Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring Cloud Function 4.2.0 -… | ||||
| CVE-2026-59284US | — | — | ||
There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.
Spring Cloud Commons 5.0.0 - 5.0.2
Spring Cloud Commons 4.3.0 - 4.3.3
Spring C… | ||||
| CVE-2026-47894US | high7.5 | — | ||
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path.
Spring Cloud Config 5.0.0 - 5.0.4
Spring… | ||||
| CVE-2026-47879US | high8.7 | — | ||
Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor.
Spring Cloud Gateway 5.0.0 - 5.0.2
Spring Cloud Ga… | ||||
| CVE-2026-47837US | critical9.8OT erhöht | — | ||
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated… | ||||
| CVE-2026-47836US | high8.1 | — | ||
The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU)… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Spring Cloud 2025.1.3 (aka Oakwood) Release vom 2026-08-20external
- Spring Security Advisory CVE-2026-47836 vom 2026-08-20external
- Spring Security Advisory CVE-2026-47837 vom 2026-08-20external
- Spring Security Advisory CVE-2026-47879 vom 2026-08-20external
- Spring Security Advisory CVE-2026-47894 vom 2026-08-20external
- Spring Security Advisory CVE-2026-59284 vom 2026-08-20external
- Spring Security Advisory CVE-2026-59291 vom 2026-08-20external
- Spring Security Advisory CVE-2026-59297 vom 2026-08-20external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan