Overview
About vulnerability
[SVG Image](#description)Description
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).
This may allow an attacker to hence execute code remotely on the server reading these rows in the database.
[SVG Image](#affected-spring-products-and-versions)Affected Spring Products and Versions
Spring Security:
- 7.0.0 - 7.0.5
[SVG Image](#mitigation)Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 7.0.x | 7.0.6 | OSS |
In the event that this upgrade causes you trouble, please look for TRACE logs detailing why deserialization is failing.
These messages are from JdbcAssertingPartyMetadataRepository and begin with:
Failed to deserialize due to …
In the event that an adjustment is needed, you can set a custom deserializer with AssertingPartyMetadataRowMapper#setCredentialsDeserializer.
[SVG Image](#references)References
- <https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H/E:U/RL:O/RC:C/CR:L/IR:H/AR:M/MAV:A/MAC:H/MPR:H/MUI:N/MS:C/MC:N/MI:H/MA:H&version=3.1>
[SVG Image](#history)History
- 2026-06-09: Initial vulnerability report published.
Details
- Affected product:
- Apache CXF , Apache Log4j , Spring , grails-core
- Affected packages:
- Spring Security @ 5.5.8 (+1760 more)