Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission
Description
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, all Steeltoe actuator endpoints default to EndpointPermissions.Restricted, which is mappeds to Cloud Foundry's read_basic_data permission (granted to Space Auditors and similar low-trust roles). Sensitive actuators including heap dump, environment, and thread dump do not raise this to EndpointPermissions.Full, so CF's read_sensitive_data permission flag is not enforced for those endpoints. Spring Boot's equivalent Cloud Foundry integration gates these endpoints with read_sensitive_data by default. Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 patch the issue. If an immediate upgrade is not possible, explicitly set RequiredPermissions = EndpointPermissions.Full in the options for HeapDumpEndpointOptions, EnvironmentEndpointOptions, and ThreadDumpEndpointOptions; and/or if heap dump, thread dump, or environment are not needed in production, register only the required actuators individually instead of using AddAllActuators().
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <4.2.0
Patches
Vulnerability mechanics
Root cause
"Missing permission escalation: sensitive actuator endpoints defaulted to `EndpointPermissions.Restricted` instead of `EndpointPermissions.Full`, so Cloud Foundry's `read_sensitive_data` permission was not enforced."
Attack vector
An attacker who has obtained a Cloud Foundry role with only `read_basic_data` permission (such as Space Auditor) can access sensitive Steeltoe actuator endpoints including `/env`, `/heapdump`, and `/threaddump` without needing the `read_sensitive_data` permission that Spring Boot's equivalent integration requires. The attacker can read environment variables, secrets, and application configuration from `/env`, and extract heap or thread dumps that may contain sensitive in-memory data. No authentication bypass is needed—the flaw is that the permission check is too permissive for these endpoints.
Affected code
The vulnerability affects the `EnvironmentEndpointOptions`, `HeapDumpEndpointOptions`, and `ThreadDumpEndpointOptions` classes in the Steeltoe.Management.Endpoint and Steeltoe.Management.EndpointCore packages. These options classes defaulted `RequiredPermissions` to `EndpointPermissions.Restricted` instead of `EndpointPermissions.Full`, which maps to Cloud Foundry's `read_basic_data` permission rather than the more restrictive `read_sensitive_data` permission. The patches modify `src/Management/src/Endpoint/Actuators/Environment/EnvironmentEndpointOptions.cs`, `src/Management/src/Endpoint/Actuators/HeapDump/HeapDumpEndpointOptions.cs`, and `src/Management/src/Endpoint/Actuators/ThreadDump/ThreadDumpEndpointOptions.cs` to override the default to `Full` [patch_id=6466803][patch_id=6466804].
What the fix does
The patches change the default `RequiredPermissions` from `EndpointPermissions.Restricted` (or `Permissions.RESTRICTED`) to `EndpointPermissions.Full` (or `Permissions.FULL`) for the environment, heap dump, and thread dump endpoints [patch_id=6466803][patch_id=6466804]. In `patch_id=6466803`, the base class property is made `virtual` and each endpoint options class overrides it with a default of `Full`. In `patch_id=6466804`, the constructors explicitly set `RequiredPermissions = Permissions.FULL` and add a fallback check for `UNDEFINED`. This ensures that Cloud Foundry's `read_sensitive_data` permission is required to access these sensitive endpoints, matching Spring Boot's behavior.
Preconditions
- configThe application must be deployed on Cloud Foundry with Steeltoe's Cloud Foundry integration enabled.
- authThe attacker must have a Cloud Foundry role that grants `read_basic_data` permission (e.g., Space Auditor) but not `read_sensitive_data`.
- networkThe sensitive actuator endpoints (/env, /heapdump, /threaddump) must be exposed and reachable over the network.
Generated on Jun 18, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- github.com/SteeltoeOSS/Steeltoe/commit/b39defa4db5f44f8696c456866b3a5b900d8d96bmitrex_refsource_MISC
- github.com/SteeltoeOSS/Steeltoe/commit/da6c604decd992f61aeef763f5814102dcb088c7mitrex_refsource_MISC
- github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-227r-jm2g-7cp4mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.