CVE-2026-56100: SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint
SpringBlade versions 2.7.3 through 3.5.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks. Attackers can exploit the gateway's authentication filter, which only validates JWT parsing without verifying user roles or caller identity, and leverage a hardcoded JWT signing key embedded in publicly available JARs to forge tokens and escalate privileges from a low-privilege user to administrator, enabling cross-tenant data pollution and persistent backdoor access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SpringBladeto a version that resolves this vulnerability.Fixed in 5.0.0 - Compensating control
Apply access control to the internal Feign user-creation endpoint exposed via @RestController so it is not unprotected/exposed without authorization checks (restrict/guard the endpoint to prevent authenticated low-privilege callers from creating administrator accounts via crafted POST requests).
Event History
Frequently Asked Questions
What access does an attacker need to use this issue?
The issue is described as exploitable by an authenticated attacker with low-privilege access. The attacker can also leverage the embedded JWT signing key to forge tokens; the provided information does not state whether any specific role is required before forging a token.
Why does gateway authentication not prevent the escalation?
The gateway authentication filter validates JWT parsing but does not verify user roles or caller identity. This allows crafted requests to reach the exposed internal user-creation endpoint without authorization checks.
What can an attacker do after successful exploitation?
An attacker can create a system administrator account, providing persistent elevated access. The stated impacts include cross-tenant data pollution and persistent backdoor access.