CVE-2026-50201: Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission
All Steeltoe actuator endpoints default to EndpointPermissions.Restricted, which is mapped to Cloud Foundry’s read_basic_data permission (granted to Space Auditors and similar low-trust roles). Sensitive actuators including heap dump, environment, and thread dump do not raise this to EndpointPermissions.Full, so CF’s read_sensitive_data permission flag is not enforced for those endpoints. Spring Boot’s equivalent Cloud Foundry integration gates these endpoints with read_sensitive_data by default.
References
- github.com/SteeltoeOSS/Steeltoe/commit/b39defa4db5f44f8696c456866b3a5b900d8d96b
- github.com/SteeltoeOSS/Steeltoe/commit/da6c604decd992f61aeef763f5814102dcb088c7
- github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-227r-jm2g-7cp4
- github.com/advisories/GHSA-227r-jm2g-7cp4
- nvd.nist.gov/vuln/detail/CVE-2026-50201
Code Behaviors & Features
Detect and mitigate CVE-2026-50201 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →