Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

steeltoe.management.endpointbase

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5NuGetPublished

    Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

    CVE-2026-50201 · GHSA-227r-jm2g-7cp4

    Affected
    • NuGet steeltoe.management.endpointbase <= 3.3.0
    Fixed in
    3.4.0· Vendor fix available
    Issue
    All Steeltoe actuator endpoints default to EndpointPermissions.Restricted, which is mapped to Cloud Foundry's readbasicdata permission (granted to Space Auditors and similar low-trust roles). Sensitive actuators including heap dump, environment, and thread dump do not raise this to EndpointPermissions.Full, so CF's readsensitivedata permission flag is not enforced for those endpoints. Spring Boot's equivalent Cloud Foundry integration gates these endpoints with readsensitivedata by default. Impact Any CF user holding Space Auditor, Space Manager, or Org Auditor role can access the heap dump, environment, and thread dump actuators for any Steeltoe application in their space. A heap dump contains all in-memory data including database passwords, bearer tokens, and VCAPSERVICES credentials. CF's readsensitivedata permission, which is specifically designed to gate this access, has no effect. Affected configuration - Application is deployed on Cloud Foundry with CF actuator and…

    Recommended action: Upgrade to 3.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →