CVE-2026-59284: Spring Cloud Commons no allow list for writable env actuator endpoint
There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
When /actuator/env is writable in Spring Cloud Commons, ensure an allow list exists for writable property keys (the issue is that there is no allow list for property keys when writable /actuator/env is enabled).
Spring Cloud Commons writable /actuator/env allow list for writable env actuator endpoint = enabled with property-key allow list
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs high privileges to access the writable /actuator/env endpoint. The CVSS vector indicates no user interaction is required and that it can be exploited over the network.
Which deployments are affected?
Deployments using Spring Cloud Commons are affected when the writable /actuator/env endpoint is enabled. Affected versions are 5.0.0 through 5.0.2, 4.3.0 through 4.3.3, 4.0.0 through 4.2.6, and 3.1.10 and earlier.
What is the impact of successful exploitation?
The issue allows modification of property keys because no allow list is enforced for the writable endpoint. The published CVSS assessment indicates high integrity impact, low availability impact, no confidentiality impact, and impact beyond the vulnerable component.