CVE-2026-59284 Spring Cloud Commons no allow list for writable env actuator endpoint
Attackers can modify arbitrary environment properties via the writable actuator endpoint, potentially leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59284?
CVE-2026-59284 is a medium-severity missing authorization vulnerability in Spring Cloud Commons, published on 27 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier
Weakness: CWE-915
Which versions are affected by CVE-2026-59284?
It affects 1 product.
Products include Broadcom Spring Cloud Commons.
How do I fix CVE-2026-59284?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-59284 being exploited?
There is no known exploitation of CVE-2026-59284 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1793201104, CLSA-2026-1793283345, GHSA-9w5v-hq8q-c6h7, ROOT-APP-MAVEN-CVE-2026-59284.