Technical impact
The vulnerability arises because Steeltoe actuator endpoints default to a low‑trust permission level that permits access to sensitive data. When the application is configured to expose all actuators, users with only basic read access, such as Cloud Foundry space auditors, can retrieve sensitive information such as heap dumps, environment variables, and thread dumps. This results in a confidentiality breach where confidential application state is disclosed without proper authorization.
Affected Systems
The issue affects the SteeltoeOSS Steeltoe.Management.Endpoint package for versions earlier than 4.2.0 and the Steeltoe.Management.EndpointCore package for versions earlier than 3.4.0. Any .NET application that incorporates these packages and either uses AddAllActuators() or relies on the default endpoint registration is vulnerable. The problem is specific to the Steeltoe OSS library ecosystem.
Risk and Exploitability
The CVSS score of 6.5 classifies the issue as medium severity. The EPSS score of less than 1% indicates low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker could reach the actuator endpoints over HTTP, likely through a publicly exposed service or an internal network. If such access is possible, sending a request to /actuator/heapdump, /actuator/env, or /actuator/threaddump, under a user with default Restricted permission, would return sensitive data. No advanced privileges are required, making the attack straightforward.
Github GHSA