CVE-2026-59297

Overview

Spring Cloud Function lets developers write business logic as plain Java functions and run that same code unchanged in very different places, from a standalone Spring Boot web application to AWS Lambda, Azure Functions or Google Cloud Functions. Its serverless web adapter goes one step further and hosts a complete Spring MVC application inside a function runtime, translating each incoming serverless event into a servlet request so that existing controllers, filters and security rules can serve it without modification.

An Incorrectly Configured Access Control vulnerability (CVE-2026-59297) has been identified in the serverless web adapter of Spring Cloud Function, which allows attackers to reach security-sensitive endpoints over a connection that the application always treats as unencrypted, because the synthesized servlet request reports the transport as insecure no matter what the actual scheme is. Protections that are only applied on an insecure channel, such as channel security rules and the Secure attribute on cookies, are therefore evaluated against a value that can never be true.

Per OWASP: Access control, sometimes called authorization, is how a web application grants access to content and functions to some users and not others. These checks are performed after authentication, and govern what 'authorized' users are allowed to do.

This issue affects applications that serve web workloads through the serverless web adapter of Spring Cloud Function.

‍

Details

Module Info

• Product: Spring Cloud Function
• Affected packages: org.springframework.cloud:spring-cloud-function-serverless-web
• Affected versions: >=4.0.3 <=4.1.6, >=4.2.0 <=4.2.7, >=4.3.0 <=4.3.4, >=5.0.0 <5.0.4
• GitHub repository: https://github.com/spring-cloud/spring-cloud-function
• Published packages: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-function-serverless-web
• Package manager: Maven
• Fixed in:
  
  • NES for Spring Cloud Function: patched releases for the 4.1.x, 4.2.x and 4.3.x lines, based on OSS 4.1.6, 4.2.4 and 4.3.4
  • OSS Spring Cloud Function 5.0.4

Vulnerability Info

This Low-severity vulnerability is found in the org.springframework.cloud:spring-cloud-function-serverless-web package in the synthesized servlet request of Spring Cloud Function.

Because a function runtime provides no real servlet container, the adapter builds the servlet request itself. Every incoming event becomes a ServerlessHttpServletRequest, and the whole Spring MVC and Spring Security stack above it reads the properties of that object as though they described a live HTTP connection. The class reports the request scheme as https, but its isSecure() implementation ignores the scheme entirely and unconditionally answers that the transport is not secure, contradicting the contract stated in its own Javadoc:

@Override
public String getScheme() {
    return "https";
}

/**
 * Return {@code true} if the {@link #setSecure secure} flag has been set to
 * {@code true} or if the {@link #getScheme scheme} is {@code https}.
 *
 * @see javax.servlet.ServletRequest#isSecure()
 */
@Override
public boolean isSecure() {
    return false;
}

Any code that gates behavior on ServletRequest.isSecure(), whether it is application code or a framework underneath it, therefore decides on a constant. Channel security rules that require a secure transport see every request as plaintext and keep redirecting or rejecting, session and authentication cookies that receive the Secure attribute only when the request is secure are emitted without it, and handlers that withhold or downgrade sensitive data on an insecure channel behave as though the deployment had no transport security at all. A remote attacker who can induce a privileged user to submit a request through the adapter can count on those protections being absent, which is why the impact is scored as a limited loss of confidentiality and integrity rather than a direct authentication bypass.

This vulnerability was introduced in 2023 with Spring Cloud Function 4.0.3.

‍

Mitigation

Only recent versions of Spring Cloud Function receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Cloud Function.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.