Application Security · Misconfiguration

Heapdump scans can leak backend secrets

A Spring Boot heapdump is a debug export, but it can hand out the secrets that keep the app connected to other systems. If an attacker can fetch it, patching the web endpoint later does not undo the credential leak already sitting in memory.

SANS saw scans against the Spring Boot heapdump path at /admin-api/actuator/heapdump, using default admin credentials. The dump can include API keys, database passwords, and other live secrets, so the blast radius reaches databases and APIs behind the web tier, not just the management URL itself.

1 source · Jul 27

Timeline

• Jul 27 Reported by SANS ISC

Sources

• Jul 27 SANS ISC

  Java Spring Boot

  Java Spring Boot "heapdump" scans, Author: Johannes Ullrich

  original

Part of the PlainSec briefing for 2026-07-27

Every edition of this story: Heapdump scans can leak backend secrets

More from today

• Dependabot slows the poisoned-release window