Security Digest · May 4, 2025 · Breach · Cloud
TeleMessage TM SGNL: Open Heap Dump Endpoint Leaked Messages
An exposed Spring Boot /heapdump on TeleMessage's archive server leaked plaintext messages and credentials in May 2025. Nothing to patch; ex-customers check.
Our verdict
Check exposure
There is nothing to patch: the flaws were in TeleMessage's hosted archive, suspended in May 2025, so former customers should treat archived messages and credentials as exposed and Spring Boot teams should confirm /heapdump is not public.
Who must act: Organizations that used TeleMessage archiving apps (TM SGNL and its WhatsApp, Telegram and WeChat variants) before May 2025, and any team running Spring Boot Actuator on internet-facing services.
Who can relax: Users of the official Signal app and organizations that never used TeleMessage; the flaws were in TeleMessage's servers, not in Signal.
- Affected
- TeleMessage archiving service through 2025-05-05 (per the CVE records)
TM SGNL and other TeleMessage archiving clients that sent messages to that service - Fixed in
- No vendor advisory; TeleMessage suspended all services on May 5, 2025
Exposed heap dump endpoint later closed, per researcher Micah Lee (Aug 2025) - CVSS
- 5.3 (v3.1, CNA)
- EPSS
- 11.1% (percentile 96)
- CISA KEV
- Yes, listed as known exploited
- Exploitation
- Exploited in the wild
- Severity
- High
What to do
- Confirm no device or account in your organization still uses a TeleMessage archiving app; follow CISA's guidance to mitigate or discontinue.
- Treat messages, contacts and phone numbers archived before May 2025 as exposed, and brief affected users and compliance.
- Rotate TeleMessage passwords, API keys and tokens, and any credentials users sent through the archived apps.
- Test your own Spring Boot services from outside for /actuator/heapdump and any custom management path such as /management/heapdump.
- Limit management.endpoints.web.exposure.include to what you need and put actuators behind Spring Security or a firewall.
How to check if you are affected or compromised
- Ask Smarsh for a written account of which of your accounts and messages were on the archive server before May 5, 2025.
- Watch for phishing and account-takeover attempts against users whose numbers and contacts were in the archive.
- In your own web logs, look for GET requests to */heapdump that returned 200 with a large body: grep -E '/(actuator|management)/heapdump' access.log.
What happened#
TeleMessage, which Smarsh acquired in 2024, sold modified messaging apps, including the Signal clone TM SGNL, that copy every message to an archive. In spring 2025 a Reuters photo showed then-national security adviser Mike Waltz using it (The Register). On May 4, 2025, 404 Media reported that a hacker had breached TeleMessage in "about 15-20 minutes". The stolen data included message contents and customer details naming Customs and Border Protection, Coinbase, Scotiabank and the Washington DC police. A second hacker claimed a similar break-in. On May 5, Smarsh said "all TeleMessage services have been temporarily suspended."
The hole was basic. As Micah Lee later detailed, the archive server answered unauthenticated requests to archive.telemessage.com/management/heapdump with a Java heap dump. The roughly 150 MB snapshot of server memory held plaintext chat logs. The admin panel also hashed passwords with MD5 in the browser, so the hash worked as the password. On May 19, DDoSecrets published 410 GB of heap dumps taken on May 4 (Lee).
MITRE published the CVEs on May 28. CVE-2025-48927: the service "configures Spring Boot Actuator with an exposed heap dump endpoint" (CVSS 3.1 5.3). CVE-2025-48928: the heap is "roughly equivalent to a 'core dump'" holding passwords sent over HTTP (4.0). CISA added both to KEV on July 1, 2025, and told agencies to mitigate or "discontinue use of the product" by July 22 (KEV, KEV). A related flaw, CVE-2025-47729, which covers cleartext copies kept on the archive backend, had entered KEV in May.
Who is affected#
Customers of TeleMessage's archiving service through May 5, 2025, the cut-off in the CVE records, and everyone they messaged. The Register summarized the leak as chat logs and metadata of more than 60 government users. The official Signal app is not affected.
Do you really need to act?#
There is no patch to apply. The bugs were in TeleMessage's hosted service, not in software customers ran. Lee said in August 2025 that the exposed endpoint and the outdated Spring Boot had been fixed (The Register). Smarsh has published no advisory. Whether TeleMessage services run again was not disclosed as of Oct 23, 2026. What remains is the data: anything that passed through the archive before the fix should be treated as exposed.
For everyone else, the lesson is the root cause: a public Spring Boot heap dump hands out whatever is in memory.
What to do now#
- Confirm nobody in your organization still uses a TeleMessage archiver. CISA's guidance is mitigate or discontinue.
- Treat messages, contacts and phone numbers archived before May 2025 as exposed. Brief the affected users and your compliance team.
- Rotate TeleMessage credentials and API keys, plus any secrets users sent through the archived apps.
- Test your own services from outside:
curl -s -o /dev/null -w '%{http_code}' https://app.example.com/actuator/heapdump, and the same for any custom management path. Expect 401, 403 or 404. - Expose only what you need via
management.endpoints.web.exposure.include. The Spring Boot docs recommend securing endpoints with Spring Security or a firewall.
How to tell if you were hit#
Former customers should ask Smarsh in writing which of your accounts and messages were on the archive server before May 5, 2025. Watch for phishing and account-takeover attempts against users whose numbers and contacts were exposed. For your own apps, search access logs: grep -E '/(actuator|management)/heapdump' access.log. A 200 response with a large body means someone took a memory snapshot. Rotate every secret that app held in memory.
Timeline#
- — Heap dumps are taken; 404 Media reports the breach.
- — Smarsh suspends all TeleMessage services.
- — DDoSecrets publishes 410 GB of heap dumps.
- — CVE-2025-48927 and CVE-2025-48928 are published.
- — CISA adds both to KEV, with a July 22 deadline.
- — Lee's DEF CON talk is reported; the endpoint has been fixed.
Vulnerability records
- CVE-2025-48927 · KEV 2025-07-01 · The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in…
- CVE-2025-48928 · KEV 2025-07-01 · The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password…
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.
Original and primary sources
- CVE record — CVE-2025-48927 cve.org
- CVE record — CVE-2025-48928 cve.org
- NVD — CVE-2025-48927 nvd.nist.gov
- NVD — CVE-2025-48928 nvd.nist.gov
- CISA — Known Exploited Vulnerabilities: CVE-2025-48927 cisa.gov
- CISA — Known Exploited Vulnerabilities: CVE-2025-48928 cisa.gov
- Micah Lee / 404 Media — The Signal clone the Trump admin uses was hacked (May 4, 2025) micahflee.com
- Micah Lee — How the knock-off Signal app used by Trump officials got hacked in 20 minutes micahflee.com
- Micah Lee — DDoSecrets publishes 410 GB of heap dumps hacked from TeleMessage's archive server micahflee.com
- Spring Boot reference — Actuator endpoints docs.spring.io