Description

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-27T20:17:56.873Z",
  "pubdate": "2026-08-27T20:17:56.873Z",
  "executiveSummary": "This vulnerability involves the improper handling of partition interceptors during the message transmission process within the Spring Cloud Stream framework. The flaw resides in the internal message production logic, allowing for potential manipulation or erroneous assignment of interceptors during the dispatch phase.\nThe vulnerability affects Spring Cloud Stream versions 5.0.0 through 5.0.2, 4.3.0 through 4.3.3, and 4.2.0 through 4.2.6. Successful exploitation could lead to message routing bypasses, delivery failures, or unauthorized message metadata modification, depending on the implementation of the interceptor chain.\nThe risk implication centers on the integrity and reliable delivery of event-driven messages. An attacker capable of influencing the message production context could potentially redirect traffic or trigger unintended side effects within the messaging infrastructure. No authentication is explicitly required if the application exposes message production entry points to untrusted input sources. Organizations should prioritize updating to patched versions to ensure message routing integrity.",
  "technicalDetails": "The vulnerability originates within the message header and interceptor processing pipeline of the Spring Cloud Stream framework. Specifically, the issue manifests during the execution of the partition selection mechanism when the message production process fails to correctly validate or sanitize the integration of partition-related interceptors.\nIn a standard Spring Cloud Stream configuration, the PartitionHandler is responsible for determining the destination partition based on message headers or expression evaluation. The defect occurs because the framework improperly adds or incorrectly maintains the scope of interceptors assigned to the message channel during this specific phase of message lifecycle management. If a message is intercepted while being prepared for transmission, the state of the partition interceptor may be inconsistent or susceptible to injection, leading to incorrect routing logic.\nThe attack flow begins when an application triggers a message send operation. If an attacker can control the input payload or associated headers that influence the partitioning logic, they may trigger an execution path where the interceptor is improperly registered or bypassed. Because the partitioning logic is often sensitive to channel configuration, a malicious actor might cause the message to be routed to a partition they control, or conversely, force a denial-of-service condition by injecting malformed interceptor data that causes downstream exception handling to fail.\nThe affected components are primarily located within the core message production flow of Spring Cloud Stream. The vulnerability exists because the framework's internal API does not enforce strict immutability or validation of the interceptor list once the message production process has commenced. This leads to a scenario where the interceptor chain becomes non-deterministic or subject to unauthorized modification based on the provided message state.\nFrom an exploitation perspective, this allows for the potential subversion of the message flow. If the interceptor is intended to enforce security policy, audit logging, or routing metadata, the improper addition or modification of this component can lead to security bypasses. In distributed systems, this could result in message leakage across partitions or the failure of critical transactional workflows that rely on precise partitioning strategies. The vulnerability remains present across versions 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6, indicating a persistent flaw in how interceptors are lifecycle-managed during message dispatch."
}