Steeltoe Management Endpoint CVE-2026-50201

Exploitation requires all of the following: (1) the target application must be deployed on Cloud Foundry - non-CF deployments do not use the EndpointPermissions/CF scope mechanism and are unaffected; (2) the application must run Steeltoe.Management.Endpoint prior to 4.2.0 or EndpointCore prior to 3.4.0; (3) the sensitive actuators (heap dump, environment, or thread dump) must be registered - this occurs automatically if AddAllActuators() is used, which is the common quick-start pattern; (4) the attacker must hold valid CF credentials with at least the Space Auditor role or any other role granted read_basic_data scope in the target CF organization and space. Exploitation is limited to Cloud Foundry environments and authenticated CF identities only; unauthenticated network access alone is insufficient.

The provided CVSS 6.5 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the risk profile: network-reachable, low complexity, requiring only low-privilege CF credentials, with high confidentiality impact and no integrity or availability consequence. Space Auditor is a routinely assigned role in enterprise CF organizations, making the effective population of potential threat actors meaningfully larger than a high-privilege-only flaw. Heap dumps and environment variables frequently contain database connection strings, API keys, cloud service credentials, and other secrets, so the confidentiality impact rating of High is appropriate. No EPSS score was provided in the source intelligence; KEV status is absent, and no public exploit code was referenced, so exploitation probability is currently unconfirmed. The lack of a POC moderates urgency somewhat, but the low exploitation bar (valid CF login + Space Auditor role) means the attack is straightforward once an attacker has any CF foothold. This is not a high-CVSS-but-low-real-risk case - the prerequisites are realistic in CF enterprise environments and the data exposed is genuinely sensitive.

A Cloud Foundry user with a Space Auditor role - a common low-trust role granted for read-only visibility into a CF space - authenticates to the CF API, then sends a standard HTTP GET request to the /actuator/env, /actuator/heapdump, or /actuator/threaddump endpoint of a vulnerable Steeltoe application. The application responds with full environment variable listings (potentially including database passwords, OAuth client secrets, and cloud service keys) or a heap dump file that can be analyzed offline to extract in-memory credentials. No public POC has been identified, but the attack requires no exploitation technique beyond crafting a valid authenticated HTTP request.