CyberRota Analysis
AI-GeneratedSpring Cloud Commons versions 3.1.10 and earlier up to 5.0.2 are vulnerable due to the lack of an allow list for property keys when the writable /actuator/env endpoint is enabled. This oversight can lead to unauthorized access and manipulation of sensitive environment properties, potentially compromising application security. Organizations using affected versions should prioritize remediation to mitigate the risk of exploitation.
CVE
CVE-2026-59284
Severity
HIGH
CVSS
7.6
EPSS
0.33%
Original NVD Description
There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier
Related CVEs
Other vulnerabilities affecting the same vendor(s)