CVE-2026-59293

Overview

Spring Integration is the Spring portfolio project that brings the Enterprise Integration Patterns to Spring applications. It provides a lightweight messaging framework of channels, endpoints, transformers and routers, together with channel adapters for protocols and technologies such as files, FTP, HTTP, JDBC, JMS, AMQP, SMB and ZeroMQ.

An Information Exposure vulnerability (CVE-2026-59293) has been identified in SmbConfig, the session configuration for the SMB channel adapters, which allows an on-path attacker to force the connection down to SMB1 and then read or alter the transferred files and capture the NTLM credentials used to authenticate the share.

Per OWASP: insecure defaults are a common source of security misconfiguration, potentially leading to privilege escalation or data exposure. Default values should be reviewed and hardened before deployment.

This issue affects the SMB channel adapters of Spring Integration.

‍

Details

Module Info

• Product: Spring Integration
• Affected packages: org.springframework.integration:spring-integration-smb
• Affected versions: >=7.1.0 <7.1.1, >=7.0.0 <7.0.6, >=6.5.0 <=6.5.10, >=6.0.0 <=6.4.12
• GitHub repository: https://github.com/spring-projects/spring-integration
• Published packages: https://central.sonatype.com/artifact/org.springframework.integration/spring-integration-smb
• Package manager: Maven
• Fixed in:
  
  • NES for Spring Integration: 6.2.x, 6.3.x, 6.4.x, 6.5.x
  • OSS Spring Integration 7.0.6, 7.1.1

Vulnerability Info

This Medium-severity vulnerability is found in the org.springframework.integration:spring-integration-smb package in the SMB support of Spring Integration.

SmbConfig holds the connection settings that every SMB session factory hands to the underlying jCIFS client, including the lowest protocol dialect the client is willing to accept during negotiation. That lower bound defaults to the oldest dialect there is:

/**
 * Defaults to and follows the jCIFS library default of 'SMB1'.
 */
private DialectVersion smbMinVersion = DialectVersion.SMB1;

Unless an application explicitly calls setSmbMinVersion(...) with a modern dialect, the client will accept an SMB1 or CIFS negotiation response. SMB1 has neither mandatory signing nor encryption, so an attacker positioned on the network path can advertise the legacy dialect, and from there read or tamper with the files that the inbound and outbound SMB adapters move, or relay the NTLM exchange that authenticates the share. The setting is a lower bound only, so the weakening happens silently: the connection still succeeds and nothing in the application signals that it is running without integrity protection.

This vulnerability was introduced in 2022 with Spring Integration 6.0.0, when the SMB adapters became a module of the framework.

‍

Mitigation

Only recent versions of Spring Integration receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Integration.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.