CVE-2026-59284

HighCVSS 7.6

Published: 27/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Summary

In Spring Cloud Commons, there is no allow list for property keys when the writable /actuator/env is enabled. Affected versions include 5.0.0-5.0.2, 4.3.0-4.3.3, 4.0.0-4.2.6, and 3.1.10 and earlier.

Risk Assessment

The risk includes the ability for unauthorized users to modify arbitrary environment properties, potentially leading to configuration changes and remote code execution.

Recommendation

It is recommended to upgrade Spring Cloud Commons to a patched version or disable the writable /actuator/env if not required.

Original NVD description (English source)

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier