CVE-2026-59292: Insecure Temporary File Permissions in Spring Integration (PropertiesPersistingMetadataStore)
Article ID: 454405
Updated On:
Products
Issue/Introduction
A Low-severity vulnerability (CVE-2026-59292) has been identified in Spring Integration affecting the PropertiesPersistingMetadataStore component. When persisting state to the local filesystem, the application creates a metadata store file in the system's shared temporary directory without sufficiently restricting file permissions. This leaves the file world-readable, allowing any other local user or process on the same host to access potentially sensitive application state, such as processed message keys, offsets, or idempotency markers.
Environment
VMware Tanzu Platform Spring
Cause
By default, PropertiesPersistingMetadataStore saves its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties. When afterPropertiesSet() creates the necessary directory and file, it uses standard Java File methods (File.mkdirs() and File.createNewFile()) and writes via a plain FileOutputStream without explicitly setting restrictive permissions.
On a standard POSIX host, the file and directory inherit the process umask (commonly 0644 for files and 0755 for directories). Because java.io.tmpdir is often a shared space (like /tmp), this exposes the properties file to unauthorized read access by anyone with local access to the system.
Resolution
To resolve this vulnerability, users of the affected Spring Integration versions must upgrade to a patched release. No further mitigation steps are required once the upgrade is applied.
Affected Versions:
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier
Fixed Versions:
7.1.x line: Upgrade to 7.1.1 (OSS) or 7.1.0.1 (Enterprise Support)
7.0.x line: Upgrade to 7.0.6 (OSS) or 7.0.5.1 (Enterprise Support)
6.5.x line: Upgrade to 6.5.11 (Enterprise Support Only)
6.4.x line: Upgrade to 6.4.13 (Enterprise Support Only)
5.5.x line: Upgrade to 5.5.22 (Enterprise Support Only)
Additional Information
Feedback
