Low

HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server

IdentifiersCVE-2026-59326CWE-532· Insertion of Sensitive Information…

CVE-2026-59326 is an information disclosure vulnerability in the Spring Boot language server used by Spring Tools for Eclipse and Spring Tools for VSCode, Cursor, and Theia. When the language server creates an outbound HTTP client and no explicit http.proxy workspace setting is configured, it logs the raw value of the https_proxy, HTTPS_PROXY, http_proxy, or HTTP_PROXY environment variable at INFO level. In environments where the proxy URL embeds Basic authentication credentials, the full credential-bearing proxy string is written to the language server log without redaction. This behavior can expose sensitive proxy authentication material through local log files and any downstream sharing of those logs.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results in disclosure of proxy credentials embedded in HTTP proxy environment variables. Exposed credentials may be accessible to other local users or processes that can read the language server logs, and may also be unintentionally disclosed when logs are attached to bug reports or otherwise shared. The primary security consequence is compromise of proxy authentication secrets, which can enable unauthorized use of the affected proxy service and potentially facilitate further access depending on the role and scope of the leaked credentials.

Mitigation

If you can’t patch tonight, do this now.

Configure an explicit http.proxy workspace setting so the vulnerable code path that logs proxy environment variables is not used. Restrict access to language server log files to minimize local exposure. Review existing logs, archived diagnostics, and bug report attachments for embedded proxy credentials and sanitize or delete them as appropriate. Where possible, avoid embedding credentials directly in proxy environment variable URLs.

Remediation

Patch, then assume compromise.

Upgrade Spring Tools for Eclipse to a release newer than 5.2.0 and Spring Tools for VSCode, Cursor, and Theia to a release newer than 2.2.0 once fixed versions are available. Because credentials may already have been exposed, rotate any proxy credentials that may have appeared in language server logs. Review retained logs and support artifacts for sensitive data exposure and remove or sanitize affected records where feasible.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

VMwareSpring Toolsapplication

VMwareSpring Tools For Cursorapplication

VMwareSpring Tools For Eclipseapplication

VMwareSpring Tools For Theiaapplication

VMwareSpring Tools For Vscodeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Jul 30, 2026

Spring security advisory (AV26-759) - Malware News - Malware Analysis, News and Indicators

A vulnerability in the Spring Boot Language Server that logs HTTP proxy credentials in plaintext.

ca ccsNews

Jul 30, 2026

Spring security advisory (AV26-759) - Canadian Centre for Cyber Security

A vulnerability in the Spring Boot Language Server that logs HTTP proxy credentials in plaintext.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-59326

NVD

nvd.nist.gov/vuln/detail/CVE-2026-59326

MITRE CWE · CWE-532

Insertion of Sensitive Information into Log File

Vendor Advisory

spring.io/security/cve-2026-59326

HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server

IdentifiersCVE-2026-59326CWE-532· Insertion of Sensitive Information…