CVE-2026-11458 Overview
CVE-2026-11458 is an information disclosure vulnerability in erzhongxmu JeeWMS affecting the Boot Actuator Endpoint at /base-boot/actuator. The flaw allows remote attackers to retrieve sensitive runtime and configuration data without authentication. JeeWMS uses a rolling release model, so specific affected version numbers are unavailable beyond the commit reference 141740afb2ba14d441c82a833d0a418d07ca2d69. A public exploit exists, and the vendor did not respond to disclosure attempts. The weakness is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).
Critical Impact
Unauthenticated remote attackers can query the exposed Spring Boot actuator endpoint to harvest configuration, environment, and operational metadata useful for follow-on attacks.
Affected Products
- erzhongxmu JeeWMS (rolling release)
- Affected commit reference: 141740afb2ba14d441c82a833d0a418d07ca2d69 and prior
- Component: Boot Actuator Endpoint (/base-boot/actuator)
Discovery Timeline
- 2026-06-07 - CVE-2026-11458 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-11458
Vulnerability Analysis
The vulnerability resides in the Spring Boot Actuator integration exposed at /base-boot/actuator within JeeWMS. Actuator endpoints provide management and diagnostic interfaces, including health, environment, configuration, and metrics data. In this deployment, those endpoints are reachable over the network without authentication or access control. An attacker can issue HTTP GET requests to the actuator paths to enumerate internal application state. Public exploit material has been released, which lowers the skill required for exploitation. The EPSS probability is 0.032%, but the availability of a public proof of concept makes opportunistic scanning likely.
Root Cause
The root cause is an improper access control configuration on the Spring Boot Actuator. Sensitive management endpoints are exposed to anonymous network clients rather than being restricted to internal management interfaces or protected by authentication. This maps directly to [CWE-200], where data intended for operators is disclosed to unauthorized parties.
Attack Vector
Exploitation is remote and unauthenticated. An attacker sends crafted HTTP requests to /base-boot/actuator and the child endpoints it lists, such as env, configprops, beans, heapdump, or mappings. Each endpoint returns structured JSON that can reveal database connection strings, internal hostnames, credentials embedded in environment variables, dependency versions, and routing information. This reconnaissance data accelerates targeted attacks against the underlying application and infrastructure. See the VulDB advisory for CVE-2026-11458 and the GitHub issue discussion for technical details.
Detection Methods for CVE-2026-11458
Indicators of Compromise
- Unauthenticated HTTP GET requests to /base-boot/actuator and sub-paths such as /env, /configprops, /heapdump, or /beans.
- Outbound responses from JeeWMS hosts containing JSON payloads with environment variables, bean names, or property sources.
- Repeated access to actuator paths from unfamiliar IP ranges, scanner user agents, or anonymizing proxies.
Detection Strategies
- Inspect web server and reverse proxy access logs for any request URI containing /actuator.
- Alert on 200-status responses to actuator endpoints from external networks.
- Use authenticated vulnerability scanners to confirm whether actuator endpoints respond without credentials.
Monitoring Recommendations
- Forward JeeWMS application and access logs into a centralized analytics platform for correlation across hosts.
- Baseline normal management traffic and flag deviations in request volume against /base-boot/actuator.
- Track outbound data volume from JeeWMS hosts to detect bulk extraction of actuator JSON or heap dumps.
How to Mitigate CVE-2026-11458
Immediate Actions Required
- Block external access to /base-boot/actuator and all sub-paths at the reverse proxy, WAF, or ingress controller.
- Require authentication and role-based authorization for any actuator endpoint that must remain enabled.
- Audit logs for prior access to actuator endpoints and rotate any credentials, tokens, or keys that may have been exposed through env or configprops.
Patch Information
No vendor patch is available. The vendor did not respond to disclosure outreach, and JeeWMS uses a rolling release model without versioned fixes. Operators must apply configuration-level mitigations until upstream changes are published. Track updates through the VulDB entry for CVE-2026-11458.
Workarounds
- Restrict the actuator endpoints to a management network or loopback interface using firewall and reverse proxy rules.
- Disable non-essential actuator endpoints in application.properties or application.yml and expose only health and info with sanitized output.
- Enforce HTTP basic or token authentication on management endpoints through Spring Security or an upstream gateway.
- Remove sensitive values from environment variables and property files so that any residual disclosure has limited utility.
# Configuration example: restrict Spring Boot Actuator exposure
management.endpoints.web.base-path=/actuator
management.endpoints.web.exposure.include=health,info
management.endpoints.web.exposure.exclude=env,beans,configprops,heapdump,mappings,threaddump
management.endpoint.health.show-details=never
management.server.address=127.0.0.1
management.server.port=8081
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
