Description

Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-27T20:17:56.293Z",
  "pubdate": "2026-08-27T20:17:56.293Z",
  "executiveSummary": "A vulnerability exists in Spring Cloud Function where sensitive information may be inadvertently exposed through application logs.\nThe vulnerability type is categorized as sensitive data exposure, resulting from improper logging practices within the framework's processing logic.\nImpacted versions include Spring Cloud Function 5.0.0 through 5.0.3, 4.3.0 through 4.3.4, 4.2.0 through 4.2.7, and 3.2.16 and earlier.\nThe risk implication involves the unauthorized disclosure of potentially sensitive data (such as headers, parameters, or internal state) to logging infrastructure or log aggregation platforms.\nAttackers do not necessarily need specialized capabilities; if they can control input processed by the vulnerable function, they may be able to trigger the logging of this input.\nThe primary exploitation requirement is the ability to submit inputs or trigger function execution that causes the vulnerable code path to execute, thereby injecting sensitive data into the logging stream.",
  "technicalDetails": "The vulnerability stems from insufficient sanitization or filtering logic within the Spring Cloud Function components responsible for handling incoming request payloads and metadata during the execution lifecycle.\nWhen a function processes a request, the framework facilitates various logging activities for debugging and observability purposes. In the affected versions, the logging mechanism fails to adequately inspect or redact sensitive data points before they are passed to the logging framework.\nThe root cause is identified as an overly permissive logging implementation that includes raw request context, including potentially sensitive headers, query parameters, or payload fragments, directly into the logs without applying necessary redaction patterns.\nAttack flow typically begins with an actor sending a request to an endpoint handled by a vulnerable Spring Cloud Function instance. This request includes crafted data within specific fields intended to be captured by the logger. Upon execution, the framework processes this data and logs the event, outputting the sensitive content in plaintext to the standard output or configured log file.\nVulnerable component: The core request processing and logging handler within Spring Cloud Function across the specified versions.\nAuthentication and privilege requirements are dependent on the deployment configuration; however, if the function is exposed to unauthenticated external actors, the vulnerability is reachable without prior authentication.\nThe post-exploitation impact includes the potential for PII (Personally Identifiable Information), credentials, or session tokens to be persisted in log management systems (e.g., ELK stack, CloudWatch, Splunk). This exposes the data to any user or system with read access to the logs, bypassing intended access controls on the application itself.\nThe vulnerability persists because the framework components lack an integrated, automated mechanism to identify and mask sensitive fields defined in the context of the function execution."
}