CVE-2026-59292

Name of the Vulnerable Software and Affected Versions Spring Integration version 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier

Description The PropertiesPersistingMetadataStore, which serves as the default file-based ConcurrentMetadataStore, saves its state to the path ${java.io.tmpdir}/spring-integration/metadata-store.properties using world-readable permissions. This allows any user on the system to read the contents of the metadata store file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.