CVE-2026-59301

Overview

Spring Cloud Function is the Spring project that lets developers write business logic as plain java.util.function beans and then run that same code as a web endpoint, a stream listener, or a serverless function. Adapter modules bind those functions to specific runtimes, and the Azure web adapter lets an existing Spring MVC web application be deployed as a single Azure Function by proxying every inbound HTTP trigger through an embedded MVC dispatcher.

An Information Exposure vulnerability (CVE-2026-59301) has been identified in the Azure web adapter, which allows attackers with access to the function's log stream to read complete HTTP request and response payloads, including credentials, tokens, and personal data that the application never intended to persist.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects the Azure web adapter of Spring Cloud Function.

‍

Details

Module Info

• Product: Spring Cloud Function
• Affected packages: org.springframework.cloud:spring-cloud-function-adapter-azure-web
• Affected versions: >=4.0.3 <=4.1.6, >=4.2.0 <=4.2.7, >=4.3.0 <=4.3.4, >=5.0.0 <5.0.4
• GitHub repository: https://github.com/spring-cloud/spring-cloud-function
• Published packages: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-function-adapter-azure-web
• Package manager: Maven
• Fixed in:
  
  • NES for Spring Cloud Function: patched releases for the 4.1.x, 4.2.x and 4.3.x lines, based on OSS 4.1.6, 4.2.4 and 4.3.4
  • OSS Spring Cloud Function 5.0.4

Vulnerability Info

This Low-severity vulnerability is found in the org.springframework.cloud:spring-cloud-function-adapter-azure-web package in the Azure web adapter of Spring Cloud Function.

AzureWebProxyInvoker is the entry point that Azure Functions invokes for every HTTP method the adapter registers, and it is annotated with an anonymous authorization level so any request reaching the function route lands in this method. Before the request is handed to the embedded MVC dispatcher, the adapter writes the entire request body to the Azure execution context logger at level INFO, which is at or below the default verbosity of an Azure Functions application. Nothing filters, truncates, or redacts the payload, so any body an attacker or an ordinary user submits, including passwords, session tokens, API keys, and personal data, is copied verbatim into the function's log stream and into whatever downstream sink Application Insights or the platform's log export is wired to.

@FunctionName(AZURE_WEB_ADAPTER_NAME)
public HttpResponseMessage execute(
    @HttpTrigger(name = "req", methods = {
        HttpMethod.GET,
        HttpMethod.POST,
        HttpMethod.PUT,
        HttpMethod.DELETE,
        HttpMethod.PATCH
    }, authLevel = AuthorizationLevel.ANONYMOUS, route = AZURE_WEB_ADAPTER_ROUTE) HttpRequestMessage<Optional<String>> request,
    ExecutionContext context) {

    context.getLogger().info("Request body is: " + request.getBody().orElse("[empty]"));

    HttpServletRequest httpRequest = this.prepareRequest(request);

The same method exposes the other half of the exchange on the way out. Once the MVC dispatcher has produced a response, the adapter serializes the full response body and writes it to the SLF4J logger at level DEBUG, a level operators routinely enable while diagnosing a function without expecting payload contents to be captured.

String responseString = httpResponse.getContentAsString(StandardCharsets.UTF_8);
if (StringUtils.hasText(responseString)) {
    if (LOGGER.isDebugEnabled()) {
        LOGGER.debug("Response: " + responseString);
    }
    responseBuilder.body(responseString);
}

Exploitation requires an attacker who can already read the function's logs, which is why the issue is rated Low. The practical risk is that log retention turns transient request and response data into a durable, broadly readable record, and that log readers are frequently a wider audience than the people cleared to see the data the application handles.

This vulnerability was introduced in 2023 with Spring Cloud Function 4.0.3.

‍

Mitigation

Only recent versions of Spring Cloud Function receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Cloud Function.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.