CVE-2026-59284

Analyzed Analyzed - Analysis Complete

Spring Cloud Commons Property Key Injection Vulnerability

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VMware

Description

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59284

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	spring_cloud_commons	to 3.1.11 (exc)
broadcom	spring_cloud_commons	From 4.0.0 (inc) to 4.2.7 (exc)
broadcom	spring_cloud_commons	From 4.3.0 (inc) to 4.3.4 (exc)
broadcom	spring_cloud_commons	From 5.0.0 (inc) to 5.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-915	The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

Executive Summary

CVE-2026-59284 is a security flaw in Spring Cloud Commons where the writable /actuator/env endpoint lacks an allow list for property keys. This allows unauthorized modification of environment properties, potentially leading to security risks like privilege escalation or data tampering.

Detection Guidance

Check if the /actuator/env endpoint is exposed and writable by sending a GET request to /actuator/env. If it returns environment properties and allows POST requests to modify them, the system is vulnerable. Use curl commands like: curl -X GET http://<target>:<port>/actuator/env and curl -X POST http://<target>:<port>/actuator/env -H 'Content-Type: application/json' -d '{"name":"anyProperty","value":"maliciousValue"}'.

Verify Spring Cloud Commons versions with: curl -X GET http://<target>:<port>/actuator/info or check dependency files like pom.xml or build.gradle for affected versions (3.1.10 and earlier, 4.0.0-4.2.6, 4.3.0-4.3.3, 5.0.0-5.0.2).

Impact Analysis

This vulnerability can allow attackers to modify sensitive application settings, escalate privileges, or tamper with data by exploiting the unprotected /actuator/env endpoint. It may lead to unauthorized access or system disruptions.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or modification, potentially breaching GDPR or HIPAA. It undermines data integrity and confidentiality controls.

Mitigation Strategies

Upgrade Spring Cloud Commons to fixed versions: 5.0.3, 4.3.4 (Enterprise), 4.2.7 (Enterprise), or 3.1.11 (Enterprise). If upgrading is not possible, set management.endpoint.env.post.valid-keys-regex to restrict writable property keys.

Disable the /actuator/env endpoint by setting management.endpoints.web.exposure.exclude=env in application.properties or application.yml.

Hi! I’m here to help you understand CVE-2026-59284. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70