Executive brief
Spring Cloud Commons is a widely-used framework component that provides shared configuration and discovery features for microservices. When the /actuator/env endpoint is configured as writable, attackers can modify arbitrary application properties without restrictions, potentially changing security settings, database credentials, or other critical configuration values—leading to unauthorized access, data theft, or service disruption.
Technical details
The vulnerability is a missing input validation (CWE-434 / improper resource validation) in Spring Cloud Commons' writable actuator endpoint. When management.endpoints.web.exposure.include contains "env" and write access is enabled, the /actuator/env endpoint fails to enforce an allow list for property keys, allowing attackers to set any application property via HTTP POST requests. The attack requires network access to the endpoint (typically admin/internal network) but no authentication if the endpoint is not secured. An attacker can inject malicious property values to disable security features, redirect traffic, or escalate privileges. Patches are available in Spring Cloud Commons 5.0.3+, 4.3.4+, 4.2.7+, and 3.1.11+.
Affected products
- VMware Spring Cloud Commons 5.0.0 - 5.0.2, 4.3.0 - 4.3.3, 4.0.0 - 4.2.6, 3.1.10 and earlier
Timeline
- 2026-08-27: disclosed: CVE-2026-59284 published