Vulnerabilities in pkg:nuget/Steeltoe.Management.EndpointBase

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-227r-jm2g-7cp4",
  "modified" : "2026-07-02T20:31:26Z",
  "published" : "2026-07-02T20:31:26Z",
  "aliases" : [ "CVE-2026-50201" ],
  "summary" : "Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission",
  "details" : "### Summary\n\nAll Steeltoe actuator endpoints default to `EndpointPermissions.Restricted`, which is mapped to Cloud Foundry's `read_basic_data` permission (granted to Space Auditors and similar low-trust roles). Sensitive actuators including heap dump, environment, and thread dump do not raise this to `EndpointPermissions.Full`, so CF's `read_sensitive_data` permission flag is not enforced for those endpoints. Spring Boot's equivalent Cloud Foundry integration gates these endpoints with `read_sensitive_data` by default.\n\n### Impact\n\nAny CF user holding Space Auditor, Space Manager, or Org Auditor role can access the heap dump, environment, and thread dump actuators for any Steeltoe application in their space. A heap dump contains all in-memory data including database passwords, bearer tokens, and VCAP_SERVICES credentials. CF's `read_sensitive_data` permission, which is specifically designed to gate this access, has no effect.\n\n### Affected configuration\n\n- Application is deployed on Cloud Foundry with CF actuator and security middleware active (added automatically by `AddAllActuators()` when a CF environment is detected).\n- The attacker holds a CF role that grants `read_basic_data`: Space Auditor, Space Manager, or Org Auditor.\n\n### Mitigations\n\nIf an immediate upgrade is not possible:\n\n- Explicitly set `RequiredPermissions = EndpointPermissions.Full` in the options for `HeapDumpEndpointOptions`, `EnvironmentEndpointOptions`, and `ThreadDumpEndpointOptions`.\n- If heap dump, thread dump, or environment are not needed in production, register only the required actuators individually instead of using `AddAllActuators()`.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "Steeltoe.Management.Endpoint"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.2.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.1.0"
    }
  }, {
    "package" : {
      "ecosystem" : "NuGet",
      "name" : "Steeltoe.Management.EndpointBase"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.4.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.3.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-227r-jm2g-7cp4"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-50201"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/SteeltoeOSS/Steeltoe/commit/b39defa4db5f44f8696c456866b3a5b900d8d96b"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/SteeltoeOSS/Steeltoe/commit/da6c604decd992f61aeef763f5814102dcb088c7"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/SteeltoeOSS/security-advisories"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-269", "CWE-285" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-02T20:31:26Z",
    "nvd_published_at" : "2026-06-17T23:17:04Z"
  }
}