CVE-2026-59284: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Spring Spring Cloud Commons

This vulnerability in Spring Cloud Commons arises because there is no allow list for property keys when the writable /actuator/env endpoint is enabled. Affected versions include 3.1.10 and earlier, 4.0.0 through 4.2.6, 4.3.0 through 4.3.3, and 5.0.0 through 5.0.2. The issue is categorized as CWE-915, indicating improperly controlled modification of dynamically-determined object attributes. The CVSS v3.1 base score is 6.6 (medium severity) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L, indicating network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, no confidentiality impact, high integrity impact, and low availability impact. There is no vendor advisory or patch information available at this time.

The vulnerability allows an attacker with high privileges to modify object attributes dynamically via the writable /actuator/env endpoint without restrictions on property keys. This can lead to integrity violations and partial availability impact. Confidentiality is not affected. The scope of impact is changed, meaning the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the writable /actuator/env endpoint if it is enabled and restrict access to it to trusted administrators only.