CVE-2026-59292

Overview

Spring Integration is the Spring portfolio project that brings the Enterprise Integration Patterns to Spring applications. It provides a lightweight messaging framework of channels, endpoints, transformers and routers, together with channel adapters for protocols and technologies such as files, FTP, HTTP, JDBC, JMS, AMQP, SMB and ZeroMQ.

An Information Exposure vulnerability (CVE-2026-59292) has been identified in PropertiesPersistingMetadataStore, the default file-based metadata store, which allows any other local user on the host to read the state the application persists, such as processed message keys, offsets and idempotency markers.

MITRE's CWE-379: Creation of Temporary File in Directory with Insecure Permissions describes this weakness as one where the product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

This issue affects the file-based metadata store of Spring Integration.

‍

Details

Module Info

• Product: Spring Integration
• Affected packages: org.springframework.integration:spring-integration-core
• Affected versions: >=7.1.0 <7.1.1, >=7.0.0 <7.0.6, >=2.0.0 <=6.5.10
• GitHub repository: https://github.com/spring-projects/spring-integration
• Published packages: https://central.sonatype.com/artifact/org.springframework.integration/spring-integration-core
• Package manager: Maven
• Fixed in:
  
  • NES for Spring Integration: 5.5.x, 6.2.x, 6.3.x, 6.4.x, 6.5.x
  • OSS Spring Integration 7.0.6, 7.1.1

Vulnerability Info

This Low-severity vulnerability is found in the org.springframework.integration:spring-integration-core package in the metadata store support of Spring Integration.

PropertiesPersistingMetadataStore is the ConcurrentMetadataStore used by default by adapters that need to remember what they have already processed. Its location defaults to a fixed path inside the shared system temporary directory, and the store creates the directory and the properties file without ever restricting their permissions:

private String baseDirectory = System.getProperty("java.io.tmpdir") + "/spring-integration/";

private String fileName = "metadata-store.properties";

@Override
public void afterPropertiesSet() {
        File baseDir = new File(this.baseDirectory);
        if (!baseDir.mkdirs() && !baseDir.exists() && this.logger.isWarnEnabled()) {
                this.logger.warn("Failed to create directories for " + baseDir);
        }
        this.file = new File(baseDir, this.fileName);
        try {
                if (!this.file.exists() && !this.file.createNewFile() && this.logger.isWarnEnabled()) {
                        this.logger.warn("Failed to create file " + this.file);
                }
        }
        catch (Exception ex) {
                throw new IllegalArgumentException("Failed to create metadata-store file '"
                                + this.file.getAbsolutePath() + "'", ex);
        }
        loadMetadata();
}

File.mkdirs() and File.createNewFile() apply only the process umask, which on a typical POSIX host leaves the directory at 0755 and the file at 0644, and the subsequent writes through a plain FileOutputStream do not change that. Because the path is predictable and lives in a directory that every local account can traverse, any other local user or process can read the metadata the application accumulates there.

This vulnerability was introduced in 2010 with Spring Integration 2.0.0.

‍

Mitigation

Only recent versions of Spring Integration receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Integration.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Uwez Khan (finder)
• Yu Bao from PayPal Cybersecurity Team (finder)