CVE-2026-50201

Name of the Vulnerable Software and Affected Versions Steeltoe.Management.Endpoint versions prior to 4.2.0 Steeltoe.Management.EndpointCore versions prior to 3.4.0

Description Steeltoe actuator endpoints default to EndpointPermissions.Restricted, which maps to Cloud Foundry's read basic data permission typically granted to low-trust roles like Space Auditors. Sensitive actuators, specifically heap dump, environment, and thread dump, fail to require EndpointPermissions.Full, meaning the read sensitive data permission flag is not enforced for these endpoints.

Recommendations Update Steeltoe.Management.Endpoint to version 4.2.0. Update Steeltoe.Management.EndpointCore to version 3.4.0. As a temporary workaround, explicitly set RequiredPermissions = EndpointPermissions.Full in the options for HeapDumpEndpointOptions, EnvironmentEndpointOptions, and ThreadDumpEndpointOptions. Avoid using AddAllActuators() and instead register only the required actuators individually if heap dump, thread dump, or environment are not needed in production.