CVE-2026-59292CWE-732

CVE-2026-59292

Low · published August 28, 2026

CVSS v3.1
3.2
EPSS
0%
Percentile
3.5
In the wild
Unconfirmed
What it is

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions.

Spring Integration 7.1.0

Spring Integration 7.0.0 - 7.0.5

Spring Integration 6.5.0 - 6.5.10

Spring Integration 6.4.0 - 6.4.12

Spring Integration 5.5.21 and earlier

The record
Technical detail
CVSS v3.1
3.2 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00146 · 3.5th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-08-28T00:17Z
Affected products (5)
ProductVersionsFixed in
vmware/spring_integration≥ 7.1.0, < 7.1.0.17.1.0.1
vmware/spring_integration< 5.5.225.5.22
vmware/spring_integration≥ 6.4.0, < 6.4.136.4.13
vmware/spring_integration≥ 6.5.0, < 6.5.116.5.11
vmware/spring_integration≥ 7.0.0, < 7.0.5.17.0.5.1
References (1)
https://spring.io/security/cve-2026-59292 · [email protected]
EPSS history
Timeline
  • 27 AUG 17:57Z
    World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)
    cvelistv5