CVE-2026-56100SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint
Updated under an hour ago ()
Does this affect you?
It affects SpringBlade. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks. Attackers can exploit the gateway's authentication filter, which only validates JWT parsing without verifying user roles or caller identity, and leverage a hardcoded JWT signing key embedded in publicly available JARs to forge tokens and escalate privileges from a low-privilege user to administrator, enabling cross-tenant data pollution and persistent backdoor access.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weakness (CWE)
- CWE-862
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Oct 1, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
SpringBlade SpringBlade springblade:springblade (from the name) | from 2.7.3 before 5.0.0 | CNA record |
References
- https://gist.github.com/sud0why/e73405057dd7414a8c221ef17e0d0059#file-cve-2026-56100-springblade-authbypass-en-mdtechnical-description, exploit
- https://github.com/chillzhuang/SpringBlade/releases#release-v5.0.0
- https://github.com/chillzhuang/SpringBlade/commit/c69b9547c942c697da2f3ee6a9265b6004abd645patch
- https://github.com/chillzhuang/SpringBladeproduct
- https://www.vulncheck.com/advisories/springblade-privilege-escalation-via-exposed-feign-endpointthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.