What is the CVSS score of CVE-2026-50201?

CVE-2026-50201 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-50201?

Yes, a patch is available for CVE-2026-50201. Update the affected software to the latest version immediately.

Steeltoe Management Endpoint CVE-2026-50201

EUVD-2026-37813 MEDIUM

Improper Privilege Management (CWE-269)

2026-06-17 GitHub_M

GHSA-227r-jm2g-7cp4

Privilege Escalation Java Steeltoe Management Endpoint Steeltoe Management Endpointbase Steeltoeoss

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable CF actuator endpoints require only low-privilege CF credentials (PR:L); impact is purely confidentiality (environment/heap data exposure) with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 02, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Jun 17, 2026 - 23:01 vuln.today

Analysis Generated

Jun 17, 2026 - 23:01 vuln.today

DescriptionCVE.org

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, all Steeltoe actuator endpoints default to EndpointPermissions.Restricted, which is mappeds to Cloud Foundry's read_basic_data permission (granted to Space Auditors and similar low-trust roles). Sensitive actuators including heap dump, environment, and thread dump do not raise this to EndpointPermissions.Full, so CF's read_sensitive_data permission flag is not enforced for those endpoints. Spring Boot's equivalent Cloud Foundry integration gates these endpoints with read_sensitive_data by default. Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 patch the issue. If an immediate upgrade is not possible, explicitly set RequiredPermissions = EndpointPermissions.Full in the options for HeapDumpEndpointOptions, EnvironmentEndpointOptions, and ThreadDumpEndpointOptions; and/or if heap dump, thread dump, or environment are not needed in production, register only the required actuators individually instead of using AddAllActuators().

AnalysisAI

Sensitive actuator endpoints in Steeltoe.Management.Endpoint and Steeltoe.Management.EndpointCore expose heap dumps, environment variables, and thread dumps to low-trust Cloud Foundry roles (Space Auditors) due to incorrect default permission levels. Affected versions inherit the base class default of EndpointPermissions.Restricted - which maps to CF's read_basic_data scope - rather than overriding to EndpointPermissions.Full (read_sensitive_data), the permission level Spring Boot's equivalent integration correctly enforces. No public exploit code or KEV listing exists at time of analysis; however, the CVSS PR:L rating reflects that any valid CF credential with Space Auditor privileges is sufficient to reach the affected endpoints.

Technical ContextAI

Steeltoe is an open-source .NET (not Java, despite an apparent tag error in the source intelligence) framework for building cloud-native applications on platforms such as Cloud Foundry (CF). Its management library exposes actuator-style endpoints analogous to Spring Boot Actuator. In CF deployments, endpoint access is governed by an EndpointPermissions enum: Restricted maps to read_basic_data (granted to Space Auditors and similar low-trust roles), while Full maps to read_sensitive_data (granted only to Space Developers and higher). Affected CPEs are cpe:2.3:a:steeltoeoss:steeltoe.management.endpoint and cpe:2.3:a:steeltoeoss:steeltoe.management.endpointbase. The root cause (CWE-269, Improper Privilege Management) is that EnvironmentEndpointOptions, HeapDumpEndpointOptions, and ThreadDumpEndpointOptions all inherited the base class RequiredPermissions property without overriding it to EndpointPermissions.Full, meaning the framework never asserted read_sensitive_data enforcement for those endpoints. The commit diffs confirm the fix: RequiredPermissions was made virtual in the base class and overridden to EndpointPermissions.Full in each of the three sensitive endpoint option classes.

RemediationAI

Vendor-released patches are Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0; upgrade to these versions or later. Fix commits are confirmed at https://github.com/SteeltoeOSS/Steeltoe/commit/b39defa4db5f44f8696c456866b3a5b900d8d96b and https://github.com/SteeltoeOSS/Steeltoe/commit/da6c604decd992f61aeef763f5814102dcb088c7. If an immediate upgrade is not possible, two workarounds exist: (1) Explicitly override RequiredPermissions to EndpointPermissions.Full in the options objects for HeapDumpEndpointOptions, EnvironmentEndpointOptions, and ThreadDumpEndpointOptions - this raises the CF permission gate to read_sensitive_data without requiring an upgrade, but must be applied to all three independently or the remaining unpatched endpoints remain exposed; (2) Avoid using AddAllActuators() and instead register only the specific actuators needed in production - this removes the sensitive endpoints from the application surface entirely, with the trade-off that diagnostic capability is reduced. The advisory is at https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-227r-jm2g-7cp4.