Sensitive Data Exposure in Steeltoe Management Endpoint and Core

CVE-2026-50201

What is CVE-2026-50201?

The Steeltoe open source project features actuator endpoints that are susceptible to unauthorized access when using default settings. Specifically, versions prior to 4.2.0 and 3.4.0 do not enforce adequate permission controls for sensitive actuators like heap dump, environment, and thread dump. These endpoints are originally set to 'EndpointPermissions.Restricted', permitting access that should be reserved for higher-trust roles. For enhanced security, it is recommended to upgrade to the latest versions or adjust permissions settings explicitly.

References