CVE-2026-59284

Spring Cloud Commons does not apply an allow list to property keys written through the writable Spring Boot /actuator/env endpoint, so nothing prevents arbitrary keys from being set. The flaw is triggered when write support on /actuator/env is enabled and a request with attacker-chosen property keys is submitted by an actor with high privileges on the application (CVSS PR:H), or by anyone who can reach the endpoint if it is left insufficiently protected. Because injected keys can modify arbitrary configuration properties, the attacker can alter application behavior beyond the component's normal scope (CVSS scope changed), yielding a high integrity impact and a limited availability impact with no confidentiality loss. Anyone running Spring Cloud Commons 3.1.10 and earlier, 4.0.0–4.2.6, 4.3.0–4.3.3, or 5.0.0–5.0.2 with the writable env endpoint enabled is affected. No exploitation is known: it is not in CISA KEV, no public proof-of-concept exists, and EPSS is about 0.3%.

What to do: Upgrade Spring Cloud Commons to a patched release beyond the affected range for your line (latest 5.0.x, 4.3.x, 4.2.x/4.0.x, or 3.1.x patch per the Broadcom advisory). Until patched, disable writes to /actuator/env (e.g., management.endpoint.env.post.enabled=false) or restrict the endpoint to trusted, highly privileged users and keep actuator endpoints off the public internet. Audit which services enable the writable env endpoint and who can reach it.