The vulnerability enables Spring Cloud Stream users to accidentally log confidential data such as credentials or personal information because the logging subsystem does not filter sensitive fields. This leads to a confidentiality breach where attackers can obtain sensitive payloads from log files. The flaw is a classic instance of data exposure and is identified by CWE-532.

Spring Cloud Stream releases 5.0.0 to 5.0.2, 4.3.0 to 4.3.3, and 4.2.0 to 4.2.6 are susceptible. Systems running these versions with default logging configurations that capture message payloads are at risk.

The CVSS score of 3.1 classifies the issue as low severity, and the EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is listed out of the KEV catalog, so no public exploitation is known. Attackers would need access to the application's log files or the ability to influence logging output; this inference is based on the description and not explicitly stated. No remote code execution or elevated privileges are required. The primary objective would be to read exposed sensitive data from logs.