SpringBlade Privilege Escalation via Hardcoded JWT Key and Unprotected Endpoint

SpringBlade versions 2.7.3 through 3.5.0 contain a critical privilege escalation vulnerability, tracked as CVE-2026-56100. The vulnerability stems from an improperly secured internal Feign user-creation endpoint exposed via a REST controller that lacks sufficient authorization checks. An attacker with low-privilege authenticated access can leverage a hardcoded JWT signing key, which is embedded within publicly available distributed JAR files, to forge arbitrary administrative tokens. The gateway's authentication filter is insufficient, as it only validates the structural integrity of the JWT without verifying the user's roles, identity, or the caller's origin. By exploiting this flaw, attackers can escalate their access level to system administrator, resulting in full unauthorized access, cross-tenant data pollution, and the establishment of persistent backdoors.

Impact

Successful exploitation of this vulnerability allows unauthorized users to elevate their privileges to administrator status. This grants them full control over the SpringBlade environment, leading to the compromise of sensitive cross-tenant data and the installation of persistent administrative backdoors. The vulnerability affects all deployments using SpringBlade versions 2.7.3 through 3.5.0.

Recommendation

Prioritize the identification and remediation of SpringBlade instances within the environment.

• Upgrade all SpringBlade instances to a version beyond 3.5.0 that addresses the hardcoded JWT secret and enforces authorization on the Feign user-creation endpoint.
• Audit access logs for anomalous POST requests directed at internal user-creation endpoints that are exposed via @RestController patterns.
• Rotate the JWT signing keys for all production SpringBlade environments immediately, as the embedded keys in existing versions are considered public knowledge.