Loading vulnerability…
HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server
CVE-2026-59326 is an information disclosure vulnerability in the Spring Boot language server used by Spring Tools for Eclipse and Spring Tools for VSCode, Cursor, and Theia. When the language server creates an outbound HTTP client and no explicit http.proxy workspace setting is configured, it logs the raw value of the https_proxy, HTTPS_PROXY, http_proxy, or HTTP_PROXY environment variable at INFO level. In environments where the proxy URL embeds Basic authentication credentials, the full credential-bearing proxy string is written to the language server log without redaction. This behavior can expose sensitive proxy authentication material through local log files and any downstream sharing of those logs.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in disclosure of proxy credentials embedded in HTTP proxy environment variables. Exposed credentials may be accessible to other local users or processes that can read the language server logs, and may also be unintentionally disclosed when logs are attached to bug reports or otherwise shared. The primary security consequence is compromise of proxy authentication secrets, which can enable unauthorized use of the affected proxy service and potentially facilitate further access depending on the role and scope of the leaked credentials.
If you can’t patch tonight, do this now.
Configure an explicit http.proxy workspace setting so the vulnerable code path that logs proxy environment variables is not used. Restrict access to language server log files to minimize local exposure. Review existing logs, archived diagnostics, and bug report attachments for embedded proxy credentials and sanitize or delete them as appropriate. Where possible, avoid embedding credentials directly in proxy environment variable URLs.
Patch, then assume compromise.
Upgrade Spring Tools for Eclipse to a release newer than 5.2.0 and Spring Tools for VSCode, Cursor, and Theia to a release newer than 2.2.0 once fixed versions are available. Because credentials may already have been exposed, rotate any proxy credentials that may have appeared in language server logs. Review retained logs and support artifacts for sensitive data exposure and remove or sanitize affected records where feasible.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.