CVE-2026-59292
published 2026-08-27CVE-2026-59292: PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to…
PriorityP411low3.2CVSS 3.1
AVLACLPRHUINSCCLINAN
EPSS
0.15%
3.5th percentile
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_integration | <= 5.5.21 | — |
| spring | spring_integration | — | — |
| spring | spring_integration | 6.4.0 – 6.4.12 | — |
| spring | spring_integration | 6.5.0 – 6.5.10 | — |
| spring | spring_integration | 7.0.0 – 7.0.5 | — |
| vmware | spring_integration | < 5.5.22 | 5.5.22 |
| vmware | spring_integration | >= 6.4.0 < 6.4.13 | 6.4.13 |
| vmware | spring_integration | >= 6.5.0 < 6.5.11 | 6.5.11 |
| vmware | spring_integration | >= 7.0.0 < 7.0.5.1 | 7.0.5.1 |
| vmware | spring_integration | >= 7.1.0 < 7.1.0.1 | 7.1.0.1 |
CVSS provenance
nvdv3.13.2LOWCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
vendor_redhat3.2LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions.
ghsa_unreviewed·2026-08-27
CVE-2026-59292 [LOW] CWE-732 PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions.
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier
VulDB
VMware Spring Integration up to 7.1.0 PropertiesPersistingMetadataStore metadata-store.properties permission assignment
vuldb·2026-08-27·CVSS 3.2
CVE-2026-59292 [LOW] VMware Spring Integration up to 7.1.0 PropertiesPersistingMetadataStore metadata-store.properties permission assignment
A vulnerability described as problematic has been identified in VMware Spring Integration up to 5.5.21/6.4.12/6.5.10/7.0.5/7.1.0. This vulnerability affects unknown code of the file spring-integration/metadata-store.properties of the component PropertiesPersistingMetadataStore. The manipulation results in incorrect permission assignment.
This vulnerability is identified as CVE-2026-59292. The attack is only possible with local access. There is not any exploit available.
Red Hat
org.springframework.integration/spring-integration-core: Spring Integration: Information disclosure via world-readable metadata file
vendor_redhat·2026-08-27·CVSS 3.2
CVE-2026-59292 [LOW] CWE-378 org.springframework.integration/spring-integration-core: Spring Integration: Information disclosure via world-readable metadata file
org.springframework.integration/spring-integration-core: Spring Integration: Information disclosure via world-readable metadata file
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier
A flaw was found in Spring Integration. The PropertiesPersistingMetadataStore component, which is the default file-based ConcurrentMetadataStore, creates a metadata file with world-readable permissions. This allows a local attacker to read the contents of the metadata-store.properties file, leading
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-27
Published