First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-59292

LowCVSS 3.2/10Last modified Aug 31, 2026

Description

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Metrics

CVSS 3.1 3.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Spring	Spring Integration	7.1.0; >= 7.0.0, <= 7.0.5; >= 6.5.0, <= 6.5.10; >= 6.4.0, <= 6.4.12; <= 5.5.21

References

https://spring.io/security/cve-2026-59292Vendor Advisory

Timeline

Published: Aug 27, 2026
Last modified: Aug 31, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-592936.6Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/enc CVE-2026-592946.5ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or CVE-2026-592955.9It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbo CVE-2026-592965.9Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that CVE-2026-592973.5Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spr CVE-2026-592983.5Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 -CVE-2026-592993.5Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function CVE-2026-593003.5Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 S CVE-2026-593014.9Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 CVE-2026-593024.9Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Clou CVE-2026-593033.8Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4 CVE-2026-593043.8Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3

CVE-2026-59292: Low severity, CVSS 3.2 | Vulnix