Spring Boot /actuator/heapdump endpoint exposes secrets in memory

Mon, 27 Jul 2026 13:44:31 +0000

Engineer — Act: Audit all Spring Boot deployments for exposed /actuator/heapdump endpoints — this endpoint leaks in-memory secrets including API keys and DB credentials. Disable or restrict actuator endpoints via Spring Security configuration if not required.
SOC/IR — Plan: Build a detection for inbound GET requests to /actuator/heapdump in web/proxy logs; active scanning activity means attackers are already probing for this endpoint in your estate.
Leader — Skip

Spring-Boot on CuraSec