CVE-2026-59326: HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server
The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentials in the form http://user:pass@proxy:8080, and the language server writes this value to its log file without any redaction. Since language server log files are often attached to bug reports or are readable by other local users/processes, this can result in disclosure of proxy credentials. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59326?
The severity of CVE-2026-59326 is classified as low with a score of 3.3.
How do I fix CVE-2026-59326?
To mitigate CVE-2026-59326, ensure that explicit http.proxy workspace settings are configured, thereby preventing the logging of sensitive proxy credentials.
What types of credentials are affected by CVE-2026-59326?
CVE-2026-59326 affects credentials embedded in corporate proxy URLs using Basic Authentication.
In which software products does CVE-2026-59326 occur?
CVE-2026-59326 occurs in Pivotal Spring Tools for Eclipse and Pivotal Spring Tools for VSCode / Cursor / Theia.
When was CVE-2026-59326 published?
CVE-2026-59326 was published on July 30, 2026.