CVE-2026-50201

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, all Steeltoe actuator endpoints default to `EndpointPermissions.Restricted`, which is mappeds to Cloud Foundry's `read_basic_data` permission (granted to Space Auditors and similar low-trust roles). Sensitive actuators including heap dump, environment, and thread dump do not raise this to `EndpointPermissions.Full`, so CF's `read_sensitive_data` permission flag is not enforced for those endpoints. Spring Boot's equivalent Cloud Foundry integration gates these endpoints with `read_sensitive_data` by default. Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 patch the issue. If an immediate upgrade is not possible, explicitly set `RequiredPermissions = EndpointPermissions.Full` in the options for `HeapDumpEndpointOptions`, `EnvironmentEndpointOptions`, and `ThreadDumpEndpointOptions`; and/or if heap dump, thread dump, or environment are not needed in production, register only the required actuators individually instead of using `AddAllActuators()`.

• CWE-269
• CWE-285

• https://github.com/SteeltoeOSS/Steeltoe/commit/b39defa4db5f44f8696c456866b3a5b900d8d96b
• https://github.com/SteeltoeOSS/Steeltoe/commit/da6c604decd992f61aeef763f5814102dcb088c7
• https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-227r-jm2g-7cp4

Published

Jun 17, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50194Steeltoe is an open source project that provides a collectio…8.2
• CVE-2026-50195containerd is an open-source container runtime. Versions pri…9.9
• CVE-2026-50196Steeltoe is an open source project that provides a collectio…7.5
• CVE-2026-50197Skipper is an HTTP router and reverse proxy for service comp…7.8
• CVE-2026-5020A vulnerability was detected in Totolink A3600R 4.1.2cu.5182…9.8
• CVE-2026-50200Steeltoe is an open source project that provides a collectio…7.5
• CVE-2026-50202Steeltoe is an open source project that provides a collectio…5.9
• CVE-2026-50203A path traversal in the SFTP provider (`SFTPHook.retrieve_di…9.1
• CVE-2026-50205System log files output unencrypted SMTP server authenticati…8.2
• CVE-2026-50206Incoming VPN network profile settings fail to process specia…6.8
• CVE-2026-50207The system Binder boundary accepts unverified pass-through A…7.8
• CVE-2026-50208High-risk TrustAllCerts routines disable standard TLS certif…9.4