The vulnerability enables Spring Cloud Stream users to accidentally log confidential data such as credentials or personal information because the logging subsystem does not filter sensitive fields. This leads to a confidentiality breach where attackers can obtain sensitive payloads from log files. The flaw is a classic instance of data exposure and is identified by CWE-200.

Spring Cloud Stream releases 5.0.0 to 5.0.2, 4.3.0 to 4.3.3, and 4.2.0 to 4.2.6 are susceptible. Systems running these versions with default logging configurations that capture message payloads are at risk.

The CVSS score of 3.1 classifies the issue as low severity, and there is no reported EPSS score or listing in the KEV catalog, implying a low exploitation probability. Attackers would need access to the application's log files or the ability to influence logging output; no remote code execution or elevated privileges are required. The primary objective would be to read exposed sensitive data from logs.