Spring Cloud Commons CVE-2026-59284

Three conditions must be simultaneously true: (1) the target application runs an affected Spring Cloud Commons version (3.1.10 and earlier, 4.0.0-4.2.6, 4.3.0-4.3.3, or 5.0.0-5.0.2); (2) the Spring Boot Actuator /actuator/env endpoint must be explicitly enabled with write (POST) access - this is non-default and requires deliberate configuration such as setting management.endpoint.env.post.enabled=true; (3) the attacker must possess or have compromised high-privileged actuator credentials, consistent with CVSS PR:H. Exploitation is limited by all three gates: applications that have never enabled writable actuator/env are completely unexposed regardless of version; those with actuator endpoints restricted to management-plane networks require prior network access to that segment; and admin credential compromise is a necessary prerequisite in all cases.

The CVSS 7.6 score (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L) captures a network-exploitable flaw with low attack complexity and a scope change, but the PR:H requirement is the dominant risk limiter - exploitation cannot proceed without prior admin credential access, meaning this vulnerability sits behind a meaningful authentication barrier. No EPSS data was provided, preventing probability-based comparison, and neither a KEV listing nor public POC code has been identified, which distinguishes this from an urgent zero-day scenario. The S:C metric is the most concerning signal: arbitrary property injection into the Spring Environment can affect components well beyond the vulnerable endpoint itself, potentially enabling configuration-based attacks such as JNDI datasource URL manipulation or logging subsystem exploitation. Organizations running Spring Cloud microservices with writable actuator endpoints exposed to broad internal networks - a common pattern in DevOps-heavy environments - face meaningfully elevated risk compared to those with actuator endpoints locked to management-plane networks. EPSS absence means the threat probability is not independently quantified; defenders should weight the scope change and widespread Spring Cloud Commons deployment footprint as the primary escalation factors.

An attacker who has obtained or compromised administrator credentials to a Spring Cloud Commons application with writable /actuator/env enabled sends a crafted HTTP POST to /actuator/env containing arbitrary property key-value pairs - such as overriding a datasource URL to a JNDI endpoint or redirecting logging configuration to an attacker-controlled server. With no allow-list enforcement, the Spring Environment accepts and applies the injected values immediately, potentially cascading integrity impacts into datasource connections, logging pipelines, or service discovery behavior without restarting the application. No public exploit code has been identified at time of analysis.