CVE-2026-47878

Executive Summary

CVE-2026-47878 is an unauthenticated Java deserialization vulnerability in Spring Batch's JDBC job repository, specifically in the DefaultExecutionContextSerializer class. Affected versions include Spring Batch 6.0.0 through 6.0.4 and all versions up to and including 5.2.6. The flaw allows an attacker to submit a malicious Base64-encoded payload that is deserialized via ObjectInputStream.readObject() without a type-restricting ObjectInputFilter, enabling untrusted class instantiation. With a CVSS score of 5.6, exploitation could lead to limited confidentiality, integrity, and availability impact, though the attack complexity is rated high. As of this writing, no patch is available, and the vulnerability remains unpatched across all tracked sources.

Technical Analysis

The vulnerability resides in the DefaultExecutionContextSerializer class, which is the default serializer used by Spring Batch's JDBC job repository for persisting execution context data. When a job execution context is retrieved from the repository, the serializer decodes a Base64-encoded string and passes the resulting raw bytes directly to ObjectInputStream.readObject().

The critical flaw is the absence of an ObjectInputFilter that would restrict which classes are permitted to be deserialized. Without such a filter, an attacker who can influence the stored execution context data (or the data passed during job operation) can craft a serialized Java payload that, when deserialized, instantiates arbitrary classes — including gadget classes that trigger command execution, file operations, or network calls.

Attack Surface:

• The JDBC job repository is enabled by default in Spring Batch when a DataSource is configured.
• Attackers who can write to the BATCH_JOB_EXECUTION_CONTEXT table (e.g., via SQL injection, a compromised service account, or an application endpoint that accepts job parameters) can inject malicious serialized payloads.
• Alternatively, if the application accepts job parameters that are stored and subsequently deserialized during execution, the attack surface widens to any input that reaches the job execution context.

Code-Level Mechanism: The vulnerable code path can be summarized as:

1. Base64-encoded string retrieved from the database.
2. Base64.getDecoder().decode(...) produces a byte[].
3. ObjectInputStream is constructed over the byte array.
4. readObject() is called without a class allowlist check.

This is a textbook instance of CWE-502 (Deserialization of Untrusted Data). The absence of an ObjectInputFilter means any class on the application's classpath that is part of a known gadget chain (e.g., Commons Collections, Spring Framework utilities) can be leveraged for exploitation.

Exploitation Scenarios

The attack chain for CVE-2026-47878 is inferred from the vulnerability class, as no public PoC is available. The following steps represent the plausible exploitation path:

Step 1: Reconnaissance / Target Identification An attacker identifies a Spring Batch application using a JDBC job repository. This can be done by fingerprinting Spring Boot actuator endpoints, observing error messages that reveal BatchConfigurer or JdbcJobInstanceDao class names, or detecting the BATCH_JOB_EXECUTION_CONTEXT table in exposed database schemas.

Step 2: Triggering the Flaw The attacker must achieve write access to the persisted execution context. Potential vectors include:

• SQL injection into the BATCH_JOB_EXECUTION_CONTEXT table (over a separate vulnerability).
• An application endpoint that accepts job parameters or execution context values, which are then persisted without sanitization.
• A compromised low-privileged database account that can insert/update rows.

Step 3: Payload / Execution Method The attacker crafts a Java serialized object (a "gadget chain") and Base64-encodes it. This payload is injected into the execution context storage. When the job repository retrieves this context for a subsequent job run, DefaultExecutionContextSerializer decodes the Base64 and passes it to ObjectInputStream.readObject(), which deserializes the payload. This triggers the gadget chain, resulting in arbitrary code execution — typically via Runtime.exec() (e.g., reverse shell, or a command that exfiltrates data) or file writes.

Step 4: Post-Exploitation Impact Given the CVSS subscores (C:L/I:L/A:L), the impact is limited but real:

• Confidentiality: Exfiltration of data accessible to the application's service account.
• Integrity: Modification of files or data the application process can write to.
• Availability: Potential for denial-of-service via resource exhaustion loops or process crashes.

The high attack complexity (AC:H) reflects the requirement that an attacker must first gain write access to the database or influence stored context data.

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

Business Impact:

• Confidentiality: Low — an attacker can only read data available to the application process; this may include database credentials, internal service endpoints, or business data if the application has broad read access.
• Integrity: Low — arbitrary file writes or data modification within the application's permissions; could alter job outcomes, business records, or configuration files.
• Availability: Low — deserialization payloads can cause excessive memory consumption (e.g., HashMap hash-collision gadget chains) or crash the JVM, leading to service downtime.

Systems Affected:

• All Spring Batch applications (versions 6.0.0–6.0.4, ≤5.2.6) using the default JdbcJobRepository with DefaultExecutionContextSerializer.
• Applications that expose job submission endpoints or allow job parameter manipulation are at higher risk.
• On-premises and cloud deployments are equally affected.

Blast Radius:

• Direct compromise is limited to the application's runtime environment and its associated service account.
• Lateral movement is possible if the compromised JVM has access to adjacent systems (e.g., middleware, other databases, shared filesystems).

CVSS Interpretation (5.6, HIGH Attack Complexity):

• Attack Vector: Network — exploitable remotely.
• Attack Complexity: High — requires preconditions (write access to context storage).
• Privileges Required: None — no authentication needed if the injection vector is unauthenticated (e.g., SQL injection).
• User Interaction: None.
• Impact: Low across all three dimensions, reflecting the constraining factors of the exploitation path.

Detection Guidance

Sigma Rule

title: Spring Batch Deserialization Attempt (CVE-2026-47878)
id: 6f7a2f54-8ab1-4e23-9c6d-3f1b9e10a2d4
status: experimental
description: Detects suspicious Java deserialization patterns in Spring Batch job execution context.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-47878
author: ValtersIT Threat Intelligence
date: 2026/05/15
logsource:
    category: application
    product: spring_batch
detection:
    selection_base64:
        - event.category: "job_repository"
        - event.action: "deserialize"
    selection_payload:
        - event.data|contains: "rO0AB"  # Java serialized object
        - event.data|contains: "H4sI"   # gzip-compressed (common in payloads)
    selection_context:
        - event.resource: "*execution_context*"
    condition: selection_base64 and selection_payload and selection_context
falsepositives:
    - Legitimate serialized context data stored by the application (rare, but possible)
level: critical
tags:
    - attack.t1190
    - cve.2026.47878
    - cwe.502

YARA Rule

rule Spring_Batch_DefaultExecutionContextSerializer_Deserialization_CVE_2026_47878
{
    meta:
        author = "ValtersIT Threat Intelligence"
        date = "2026-05-15"
        description = "Detects Java serialized payloads targeting Spring Batch DefaultExecutionContextSerializer"
        cve = "CVE-2026-47878"
        severity = "high"
    strings:
        $class_marker = "org.springframework.batch.core.repository.dao.DefaultExecutionContextSerializer"
        $object_input_stream = "java.io.ObjectInputStream"
        $read_object = "readObject"
        $base64_class = "java.util.Base64"
    condition:
        ($class_marker and $read_object) or
        ($object_input_stream and $read_object and #payload_annotation >= 0) or
        all of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-47878 Spring Batch DefaultExecutionContextSerializer Deserialization Exploit"; flow:to_server,established; content:"rO0AB"; http_client_body; content:"execution_context"; http_client_body; reference:cve,2026-47878; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-47878; sid:202647878; rev:1; metadata:attack_target_server, created_at_2026_05_15, deployment_spring, tag_deserialization;)

Elastic Detection

sequence by host.name, process.entity_id
  [ process where event.action == "exec" and
      process.args : ("java", "javaw", "spring-boot*") ]
  [ file where event.action == "write" and
      file.name : ("BATCH_JOB_EXECUTION_CONTEXT*", "*execution_context*") ]
  [ process where event.action == "exec" and
      process.command_line : (
        "*/bin/sh*",
        "*curl*",
        "*wget*",
        "*powershell*"
      ) and process.parent.name : "java" ]

Splunk SPL Query

index=java_apps sourcetype=spring_batch
| where match(_raw, "rO0AB") OR match(_raw, "H4sI[A-Za-z0-9+/=]+")
| table _time, host, source, message
| eval suspicious = if(match(message, "(?i)deserialize|readObject|execution_context"), "possible CVE-2026-47878 exploitation", "watch")
| search suspicious="possible CVE-2026-47878 exploitation"
| stats count by host, source, suspicious
| sort - count

Wazuh OSSEC Rule

<rule id="452514" level="15">
    <decoded_as>json</decoded_as>
    <field name="source">spring_batch</field>
    <regex>rO0AB|H4sI</regex>
    <description>CVE-2026-47878 - Spring Batch DefaultExecutionContextSerializer deserialization attempt detected</description>
    <group>deserialization,execution_context,spring_batch,</group>
    <mitre>
        <id>T1190</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No vendor advisory, security patch, or updated artifact has been identified from any tracked source at the time of writing. The affected version ranges (6.0.0–6.0.4 and ≤5.2.6) have no fixed releases yet.

1. Immediate Mitigations

• Disable JDBC job repository if not strictly required: Switch to MapJobRepositoryFactoryBean (in-memory job repository) or a non-JDBC implementation if persistence is not a hard requirement.
• Restrict database access: Apply least-privilege principles to the database account used by Spring Batch. Ensure the account cannot INSERT or UPDATE the BATCH_JOB_EXECUTION_CONTEXT table from unauthenticated or low-trust network segments.
• Network access controls: Restrict network exposure of the application and its database to trusted segments only. Use firewalls to block external connections to the database port and minimize the application's exposure to untrusted parties.
• Web Application Firewall (WAF) rules: Deploy WAF rules to inspect Base64-encoded payloads for rO0AB markers and block requests containing serialized Java objects in job-related parameters.

2. Patch / Upgrade Steps

• Monitor the Spring Batch project's security advisories and GitHub releases for a fix. Expected fix: an ObjectInputFilter allowlist added to DefaultExecutionContextSerializer.
• When a patched version is released, upgrade to the latest Spring Batch version within your major line:
  • For 6.0.x users: upgrade to the newest 6.0.x (currently 6.0.4+ expected after fix) or latest 6.x.
  • For 5.x users: upgrade to the latest 5.2.x with the fix or migrate to 6.x.
• Test the upgrade in a staging environment before production deployment, particularly validating that job execution contexts serialize/deserialize correctly.

3. Long-Term Hardening

• Implement a global ObjectInputFilter: If you extend Spring Batch or use custom serializers, install a JVM-wide ObjectInputFilter that allowlists only trusted application classes (e.g., via a Java agent or -Djava.security.properties).
• Defense-in-depth for database writes: Implement application-level validation to reject any job execution context field that contains Java serialization markers (AC ED 00 05 in hex or rO0AB in Base64) unless it is a known, trusted serialized object.
• Use signed/encrypted context storage: If feasible, encrypt execution contexts and enforce integrity checks (e.g., HMAC) so only the application itself can write valid serialized data.
• Continuous monitoring: Deploy the detection rules provided above in your SIEM/EDR stack and review alerts for any deserialization-related activity.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-47878
2. Spring Project (Vendor): https://spring.io/projects/spring-batch — monitor for security advisories and release notes
3. CWE-502 — Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
4. GitHub Advisory (future): https://github.com/spring-projects/spring-batch/security/advisories — check for an interim advisory that may be published
5. CISA KEV: Not listed — no known exploitation-in-the-wild has been confirmed; monitoring is recommended.

Threat Actor Activity: No known campaigns, exploit-in-the-wild evidence, or research publications have been identified as of the report date. The vulnerability is unpatched, which increases the likelihood of future exploit development, particularly as the affected component (DefaultExecutionContextSerializer) is a default and widely used class in Spring Batch deployments.