CVE-2026-59292 World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)
Local attackers can read sensitive metadata from world-readable temporary files in Spring Integration applications.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59292?
CVE-2026-59292 is a low-severity vulnerability in Spring Integration, published on 27 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Weakness: CWE-732
Which versions are affected by CVE-2026-59292?
It affects 1 product.
Products include Vmware Spring Integration.
How do I fix CVE-2026-59292?
Upgrade to a fixed version.
Is CVE-2026-59292 being exploited?
There is no known exploitation of CVE-2026-59292 in the wild and no public exploit code.
Other vulnerabilities in Spring Integration
- CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
- CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
- CVE-2026-40987 Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem
- CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
- CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1
Sources
Also known as CLEANSTART-2026-KI57561, GHSA-5xq7-3cgg-j383.