Skip to content
CVE PROGRAM SOURCE RECORD6.6 Medium

CVE-2026-59284

Spring Cloud Commons no allow list for writable env actuator endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring Cloud Commons

Default version status: unaffected

  • 5.0.0 to ≤ 5.0.2affected
  • 4.3.0 to ≤ 4.3.3affected
  • 4.0.0 to ≤ 4.2.6affected
  • 0 to ≤ 3.1.10affected

References