This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] VMware Spring fixes 91 vulnerabilities
As part of its August patches, VMware Spring fixes 91 vulnerabilities in various products. Selected vulnerabilities are described below. The full list of vulnerabilities, including fixed versions, can be found at [1] by expanding the individual advisories.
An unauthenticated remote attacker can read or modify entries in the LDAP directory due to a hard-coded administrator account and the LDAP listener being exposed on all network interfaces in Spring Security. Only applications using UnboundIdContainer or spring.ldap.embedded.* with the unboundid-ldapsdk dependency are affected [2][3].
The vulnerability is present in product:
- Spring Security; >=7.1.0, <=7.1.0; >=7.0.0, <=7.0.6; >=6.5.0, <=6.5.11; >=6.4.0, <=6.4.18; >=5.8.0, <=5.8.27; >=5.7.0, <=5.7.25
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
More information:
- CVE-2026-59270 at cve.org, NVD
- CWE-798: Use of Hard-coded Credentials at cwe.mitre.org
The vulnerability was publicly disclosed 20. 8. 2026.
An unauthenticated remote attacker can inject and execute arbitrary JavaScript in the user's browser due to missing HTML encoding of inputs on the default consent page of Spring Authorization Server. Applications with a custom consent page are not affected [4][5].
The vulnerability is present in product:
- Spring Authorization Server; >1.5.0, <=1.5.8; >=1.4.0, <=1.4.11
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
More information:
- CVE-2026-59316 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 20. 8. 2026.
An unauthenticated remote attacker can cause information leakage between requests and misrouting of responses between users in Spring Integration. Affected are applications using fluxTransform() with an asynchronous or order-changing function that returns unwrapped payloads instead of Message objects [6][7].
The vulnerability is present in product:
- Spring Integration; >=7.1.0, <7.1.0; >=7.0.0, <=7.0.5; >=6.5.0, <=6.5.10; >=6.4.0, <=6.4.12, <=5.5.21
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
More information:
- CVE-2026-59324 at cve.org, NVD
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') at cwe.mitre.org
The vulnerability was publicly disclosed 20. 8. 2026.
An unauthenticated remote attacker can potentially execute arbitrary code due to unsafe deserialization when processing paginated GraphQL queries in Spring for GraphQL [8][9].
The vulnerability is present in product:
- Spring for GraphQL; >=2.0.0, <=2.0.4
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-59285 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
An authenticated remote attacker can use prompt injection in Spring AI to invoke a tool not exposed for the given request and potentially escalate privileges [10][11].
The vulnerability is present in product:
- Spring AI; >=2.0.0, <=2.0.0; >=1.1.0, <=1.1.8, >=1.0.0, <=1.0.9
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
More information:
- CVE-2026-59318 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 20. 8. 2026.
Links
- [1] https://spring.io/security
- [2] https://spring.io/security/cve-2026-59270
- [3] https://nvd.nist.gov/vuln/detail/cve-2026-59270
- [4] https://spring.io/security/cve-2026-59316
- [5] https://nvd.nist.gov/vuln/detail/cve-2026-59316
- [6] https://spring.io/security/cve-2026-59324
- [7] https://nvd.nist.gov/vuln/detail/cve-2026-59324
- [8] https://spring.io/security/cve-2026-59285
- [9] https://www.cve.org/CVERecord?id=CVE-2026-59285
- [10] https://spring.io/security/cve-2026-59318
- [11] https://nvd.nist.gov/vuln/detail/cve-2026-59318
By CESNET, z.s.p.o. Michaela Jarošová on 31. 8. 2026.