RoastMyOpsec

Vulnerabilities

Spring Actuator vs Apache server-status on Production

December 27, 2025

Spring Actuator vs Apache server-status on production is two live diagnostics that must not be world-readable. Actuator endpoints can expose env, beans, heap dumps, and gateway routes depending on what you enabled. mod_status /server-status exposes workers and sometimes request lines. phpinfo() is the PHP cousin. A liveness probe that returns {"status":"UP"} without details is fine. /actuator/env on the marketing host is not. RoastMyOpsec does not currently score /actuator, /server-status, or phpinfo.php. It does not fetch heap dumps or enable management endpoints.

The practical difference

Actuator is the application. server-status is the HTTP server. Framework DEBUG is every 500. Lock each layer. Disallow in robots.txt only advertises names.

Spring Boot 3 often maps management to a separate port. Keep that port off the public CDN. If it must share 443, authenticate and expose health only.

How to choose what to expose

Public origin: health without details, or nothing. Management port: localhost, VPN, or mTLS. CDN: deny /actuator and /server-status even if 'the app is internal.' Staging: same rules if the hostname is guessable.

SurfaceTypical leakPublic originTakeaway
/actuator/env / beansConfig and wiringNoNot a scored roast path; deny anyway
/actuator/healthUP/DOWNBare status only if neededNo details payload
/server-statusWorkers, URIsNoSee server-status vs phpinfo
DEBUG trueEvery error dumpNoSee framework debug

What the roast can prove

A 404 on /actuator is not proof the management port is closed. Edge deny is cheap. Pair with swagger vs GraphQL if /actuator/openapi is also public, and with exposed .env if the dump named secrets.

Common mistakes

The first mistake is management.endpoints.web.exposure.include=* on the public host.

The second mistake is health.show-details=always for a prettier status page.

The third mistake is Disallow: /actuator and calling it access control.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Is /actuator/health a vulnerability?
A boolean UP is usually fine. Details, env, and dumps are the miss.
Does RoastMyOpsec fetch Actuator?
Not as scored paths today. Deny /actuator on the public origin anyway.
Is this only Spring?
The class is any management UI: Actuator, server-status, phpinfo, Micrometer dumps. Same deny list.

Sources

Related guides