CVE-2026-50201 Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission
Low-privilege users can access sensitive heap dumps and environment variables due to insufficient permission checks in Steeltoe actuators.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50201?
CVE-2026-50201 is a medium-severity missing authorization vulnerability in SteeltoeOSS Steeltoe.Management.Endpoint, published on 17 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, all Steeltoe actuator endpoints default to `EndpointPermissions.Restricted`, which is mappeds to Cloud Foundry's `read_basic_data` permission (granted to Space Auditors and similar low-trust roles). Sensitive actuators including heap dump, environment, and thread dump do not raise this to `EndpointPermissions.Full`, so CF's `read_sensitive_data` permission flag is not enforced for those endpoints. Spring Boot's equivalent Cloud Foundry integration gates these endpoints with `read_sensitive_data` by default. Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 patch the issue. If an immediate upgrade is not possible, explicitly set `RequiredPermissions = EndpointPermissions.Full` in the options for `HeapDumpEndpointOptions`, `EnvironmentEndpointOptions`, and `ThreadDumpEndpointOptions`; and/or if heap dump, thread dump, or environment are not needed in production, register only the required actuators individually instead of using `AddAllActuators()`.
Which versions are affected by CVE-2026-50201?
4 open source packages ship an affected version, including Steeltoe.Management.Endpoint and Steeltoe.Management.EndpointBase.
| Package | Affected | Fixed in |
|---|---|---|
Steeltoe.Management.Endpoint NuGet | All versions | 4.2.0 |
Steeltoe.Management.Endpoint NuGet | All versions | 4.2.0 |
Steeltoe.Management.EndpointBase NuGet | All versions | 3.4.0 |
Steeltoe.Management.EndpointBase NuGet | All versions | 3.4.0 |
How do I fix CVE-2026-50201?
Upgrade Steeltoe.Management.Endpoint to 4.2.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-50201 being exploited?
There is no known exploitation of CVE-2026-50201 in the wild and no public exploit code.
Sources
Also known as GHSA-227r-jm2g-7cp4.