CVE-2026-56100: SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint
SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks. Attackers can exploit the gateway's authentication filter, which only validates JWT parsing without verifying user roles or caller identity, and leverage a hardcoded JWT signing key embedded in publicly available JARs to forge tokens and escalate privileges from a low-privilege user to administrator, enabling cross-tenant data pollution and persistent backdoor access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SpringBladeto a version that resolves this vulnerability.Fixed in 5.0.0 - Configuration
Add authorization checks to the internal Feign user-creation endpoint exposed via @RestController so crafted POST requests cannot create system administrator accounts without proper authorization.
SpringBlade (Feign user-creation endpoint exposed via @RestController) Authorization checks for Feign user-creation endpoint = enabled
Event History
Frequently Asked Questions
What access does an attacker need to use this issue?
The issue is described as exploitable by an authenticated attacker with low-privilege access. The attacker can also leverage the embedded JWT signing key to forge tokens; the provided information does not state whether any specific role is required before forging a token.
Why does gateway authentication not prevent the escalation?
The gateway authentication filter validates JWT parsing but does not verify user roles or caller identity. This allows crafted requests to reach the exposed internal user-creation endpoint without authorization checks.
What can an attacker do after successful exploitation?
An attacker can create a system administrator account, providing persistent elevated access. The stated impacts include cross-tenant data pollution and persistent backdoor access.