CVE-2020-5427: VMware Spring Cloud Data Flow

High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days.

In Spring Cloud Data Flow, versions 2.6.x prior to 2.6.5, versions 2.5.x prior 2.5.4, an application is vulnerable to SQL injection when requesting task execution.

Affected products

• VMware Spring Cloud Data Flow: from 2.5.0, before 2.5.4 (fixed in 2.5.4); from 2.6.0, before 2.6.5 (fixed in 2.6.5)

Published 2021-01-27. Last modified 2026-06-17.