CVE-2026-56100 in SpringBlade
Summary
by MITRE • 08/28/2026
SpringBlade versions 2.7.3 through 3.5.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks. Attackers can exploit the gateway's authentication filter, which only validates JWT parsing without verifying user roles or caller identity, and leverage a hardcoded JWT signing key embedded in publicly available JARs to forge tokens and escalate privileges from a low-privilege user to administrator, enabling cross-tenant data pollution and persistent backdoor access.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified within SpringBlade versions 2.7.3 through 3.5.0 represents a critical failure in authentication and authorization mechanisms, specifically classified under CWE-269 Improper Privilege Management and CWE-862 Missing Authorization. This flaw stems from the exposure of an internal Feign user-creation endpoint via @RestController without implementing adequate access controls. The core technical issue lies in the gateway's authentication filter logic, which is designed to validate JSON Web Tokens for basic session integrity but fails to perform rigorous role-based or identity verification checks on incoming requests directed at sensitive administrative endpoints. Consequently, any authenticated user possessing a valid JWT can interact with this endpoint regardless of their actual privilege level within the application hierarchy.
The exploitation vector relies heavily on two compounding factors: the lack of authorization middleware for specific internal APIs and the presence of hardcoded cryptographic keys in distributed artifacts. Attackers who have obtained low-privilege credentials can leverage these tokens to send crafted POST requests to the unprotected user-creation endpoint. By exploiting the gateway's permissive validation logic, which accepts any syntactically correct JWT without verifying its scope or intended audience for administrative actions, attackers bypass standard security boundaries. Furthermore, the use of a hardcoded JWT signing key embedded in publicly available JAR files significantly lowers the barrier to entry. This allows adversaries not only to forge tokens with elevated privileges but also to predict token structures and manipulate claims effectively, facilitating seamless privilege escalation from a regular user account to that of a system administrator.
The operational impact of this vulnerability is severe, enabling persistent backdoor access and cross-tenant data pollution in multi-tenant environments typical of SaaS platforms built on SpringBlade. Once an attacker escalates privileges, they gain the ability to create new administrative accounts, modify existing user permissions, and alter critical system configurations without detection by standard audit logs that may not flag self-created admin accounts as anomalous if no additional behavioral analysis is in place. This leads to a complete compromise of data integrity and confidentiality across tenant boundaries, allowing for unauthorized data exfiltration or manipulation. The persistence aspect arises because the attacker can maintain access through newly created administrator accounts even if original credentials are rotated, creating a resilient foothold within the infrastructure.
Mitigation strategies must address both the architectural flaw in API exposure and the cryptographic weakness. Immediately, organizations should restrict access to internal Feign endpoints by ensuring they are not exposed via public-facing REST controllers or by implementing strict role-based access control checks at the gateway level for all administrative operations. It is imperative to remove hardcoded JWT signing keys from JAR files and replace them with secure, dynamically managed secrets stored in a dedicated vault such as HashiCorp Vault or AWS Secrets Manager. Additionally, deploying Web Application Firewalls with rules that detect anomalous privilege escalation patterns can provide an additional layer of defense. Regular security audits focusing on authentication filter logic and comprehensive penetration testing to identify unprotected internal endpoints are essential for maintaining the integrity of SpringBlade deployments in production environments aligned with MITRE ATT&CK techniques related to Account Manipulation and Credential Access.