Spring Security Advisories

RSS feed

Spring Cloud Commons no allow list for writable env actuator endpoint

HIGH | AUGUST 20, 2026 | CVE-2026-59284

Description

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.

Affected Spring Products and Versions

Spring Cloud Commons:

  • 5.0.0 - 5.0.2
  • 4.3.0 - 4.3.3
  • 4.0.0 - 4.2.6
  • 3.1.10 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
Fix versionAvailability
5.0.3OSS
4.3.4Enterprise Support Only
4.2.7Enterprise Support Only
3.1.11Enterprise Support Only

Set management.endpoint.env.post.valid-keys-regex to a valid regular expression that only matches property keys that are allowed to be dynamically updated.

References

History

  • 2026-08-20: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all