The Spring Boot language server logs the raw values of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variables at INFO level whenever it constructs an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs often embed Basic‑authentication credentials, and the server writes this unredacted value to its log file. The logging of these credentials amounts to a disclosure of sensitive information (CWE-532).

Spring Tools for Eclipse versions 5.2.0 and earlier, and Spring Tools for VSCode / Cursor / Theia versions 2.2.0 and earlier are affected.

The CVSS score of 3.3 indicates a low‑impact vulnerability, and the EPSS score of less than 1% suggests a very low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker who gains access to the environment running the language server or to its log files can read the logged proxy credentials. No remote code execution or privilege escalation is possible, but the exposure of authentication data could be leveraged against the corporate proxy or downstream services.