vetkit.spring.actuator.security-disabled
Spring Boot 1.x Actuator security is switched off (management.security.enabled=false or endpoints.sensitive=false). Sensitive endpoints such as /env, /heapdump and /trace become reachable without authentication.
Last updated:
Suite: Security
regex
Spring Boot 1.x Actuator security is switched off (management.security.enabled=false or endpoints.sensitive=false). Sensitive endpoints such as /env, /heapdump and /trace become reachable without authentication.
Category: SECURITY · Engine rule severity: ERROR
How to fix it
Remove the setting and protect Actuator with Spring Security; upgrade off the unsupported Spring Boot 1.x line.
References
Source: packages/engine/rules/sast/config.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.