CVE-2026-59291: Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function
Published Aug 27, 2026
·Updated
Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7
Affected Software
3 affected components
Spring Cloud Function>=5.0.0<=5.0.3
Spring Cloud Function>=4.3.0<=4.3.4
Spring Cloud Function>=4.2.0<=4.2.7
Event History
Aug 27, 2026
CVE Published
via MITRE·05:57 PM
Data Sourced
via MITRE·05:57 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverity
Frequently Asked Questions
1
Which versions are affected?
Affected versions are Spring Cloud Function 5.0.0 through 5.0.3, 4.3.0 through 4.3.4, and 4.2.0 through 4.2.7.
2
What access and conditions does an attacker need?
The vector is network-based, but exploitation has high attack complexity. The attacker must already have high privileges and requires user interaction.
3
What is the potential impact if exploitation succeeds?
The issue may allow arbitrary file reads and server-side request forgery. The stated impact is limited to integrity, with no listed confidentiality or availability impact.