CVE-2026-59292: World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected by default?
Deployments using PropertiesPersistingMetadataStore, identified as the default file-based ConcurrentMetadataStore, are affected in the listed Spring Integration releases. The persisted metadata file is written under the JVM temporary directory.
How can I check whether an instance is exposed?
Inspect ${java.io.tmpdir}/spring-integration/metadata-store.properties on the host. An affected instance has this metadata file with world-readable permissions.
What access would an attacker need, and what is the likely impact?
The supplied severity vector indicates local access and high privileges are required. The impact is limited to low confidentiality impact; no integrity or availability impact is indicated.