--- title: Micronaut Framework 5.2.4 Released! | daily.dev description: Micronaut Framework 5.2.4 is a security release fixing two high-severity vulnerabilities in Micronaut Control Panel 2.2.1. GHSA-f9fp-ghwv-vgqq (CVSS 7.5) let... canonical: https://daily.dev/posts/micronaut-framework-5-2-4-released--8kha4vh02 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Micronaut Framework 5.2.4 Released! | daily.dev og:description: Micronaut Framework 5.2.4 is a security release fixing two high-severity vulnerabilities in Micronaut Control Panel 2.2.1. GHSA-f9fp-ghwv-vgqq (CVSS 7.5) let... og:url: https://daily.dev/posts/micronaut-framework-5-2-4-released--8kha4vh02 og:image: https://api.daily.dev/og/posts/8kHa4vh02.png og:image:alt: Micronaut Framework 5.2.4 Released! og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Micronaut Framework 5.2.4 Released! **[Micronaut Framework](https://daily.dev/sources/micronaut)** · 3 min read · 0 upvotes · 0 comments ## Summary Micronaut Framework 5.2.4 is a security release fixing two high-severity vulnerabilities in Micronaut Control Panel 2.2.1. GHSA-f9fp-ghwv-vgqq (CVSS 7.5) let an attacker with network access run arbitrary SQL and read datasource credentials when the panel is reachable without authentication, the default in dev and test environments when Micronaut Security is absent. GHSA-mfx7-wpg7-324q (CVSS 8.8) let a read-only user bypass authorization by appending a trailing slash to write endpoints. The fix requires same-origin requests, makes the SQL console read-only by default, and restricts unauthenticated access to an allowlist of loopback hosts. The release also bundles Micronaut Core 5.2.20, Data 5.2.4, Serialization 3.2.6, Object Storage 3.1.2 and Sourcegen 2.2.4. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerability does Micronaut Control Panel 2.2.1 fix with CVSS score 8.8? It fixes GHSA-mfx7-wpg7-324q, an authorization bypass where the router classified a request as a write by matching its raw path but ignored a trailing slash. A user with only read access could reach write endpoints by appending '/' to the path, letting them run arbitrary SQL or upload objects to configured object stores. Version 2.2.1 normalizes the request path before deciding if it's a write. _Teams running Micronaut Control Panel can track these CVE fixes and version updates on daily.dev._ ### Why is Micronaut Control Panel vulnerable to unauthenticated SQL injection by default in dev environments? GHSA-f9fp-ghwv-vgqq (CVSS 7.5) affects setups where the Control Panel is reachable without authentication, which is the default in the dev and test environments when Micronaut Security is absent, or when micronaut.control-panel.security.access=ANONYMOUS is set. An attacker with network access, via DNS rebinding or a forged cross-site request, could run arbitrary SQL through the datasource panel and read datasource passwords and schema. _Developers securing Micronaut apps can stay on top of advisories like this on daily.dev._ ### What changed in Micronaut Core 5.2.20 related to configuration and environment handling? Micronaut Core 5.2.20 fixes four configuration issues: property caches no longer hold a value read before a property source was added, placeholders in config import declarations are now resolved, environment refresh issues remaining after earlier 5.2.16-5.2.18 fixes are resolved, and ${random.*} values stay stable when a property source is processed. _Developers debugging Micronaut config refresh issues can follow framework fixes like this on daily.dev._ ## Similar posts on daily.dev - [Micronaut 5.0.0-RC1 Released\!](https://daily.dev/posts/micronaut-5-0-0-rc1-released--1t1y548lo) · Micronaut Framework · 0 upvotes · 0 comments - [Micronaut 5.0.0-M3 Released\!](https://daily.dev/posts/micronaut-5-0-0-m3-released--3trxdpoa6) · Micronaut Framework · 0 upvotes · 0 comments - [Java News Roundup: WildFly, Micronaut, Spring AI, Apache Fory, GlassFish Plugin, Open Liberty](https://daily.dev/posts/java-news-roundup-wildfly-micronaut-spring-ai-apache-fory-glassfish-plugin-open-liberty-bjm9krmxy) · InfoQ · 5 upvotes · 0 comments - [Java Weekly, Issue 651](https://daily.dev/posts/java-weekly-issue-651-7x5pkychj) · Baeldung · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#sql](https://daily.dev/tags/sql) [View this post on daily.dev](https://daily.dev/posts/micronaut-framework-5-2-4-released--8kha4vh02) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Micronaut Framework 5.2.4 Released!","url":"https://daily.dev/posts/micronaut-framework-5-2-4-released--8kha4vh02","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/micronaut-framework-5-2-4-released--8kha4vh02"},"datePublished":"2026-10-27T08:24:22.631Z","dateModified":"2026-10-27T08:24:53.805Z","description":"Micronaut Framework 5.2.4 is a security release fixing two high-severity vulnerabilities in Micronaut Control Panel 2.2.1. GHSA-f9fp-ghwv-vgqq (CVSS 7.5) let...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f08a6eda79779d4df3cf6d8e5208da62?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f08a6eda79779d4df3cf6d8e5208da62?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Micronaut Framework","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Micronaut Framework","logo":"https://media.daily.dev/image/upload/s--4qJg2Z3S--/f_auto,q_auto/v1773648751/logos/micronaut?_a=BAMAMiiu0","url":"https://daily.dev/sources/micronaut"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/micronaut-framework-5-2-4-released--8kha4vh02","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,java,sql","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Micronaut Framework","item":"https://daily.dev/sources/micronaut"},{"@type":"ListItem","position":3,"name":"Micronaut Framework 5.2.4 Released!"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/micronaut-framework-5-2-4-released--8kha4vh02#faq","mainEntity":[{"@type":"Question","name":"What vulnerability does Micronaut Control Panel 2.2.1 fix with CVSS score 8.8?","acceptedAnswer":{"@type":"Answer","text":"It fixes GHSA-mfx7-wpg7-324q, an authorization bypass where the router classified a request as a write by matching its raw path but ignored a trailing slash. A user with only read access could reach write endpoints by appending '/' to the path, letting them run arbitrary SQL or upload objects to configured object stores. Version 2.2.1 normalizes the request path before deciding if it's a write. Teams running Micronaut Control Panel can track these CVE fixes and version updates on daily.dev."}},{"@type":"Question","name":"Why is Micronaut Control Panel vulnerable to unauthenticated SQL injection by default in dev environments?","acceptedAnswer":{"@type":"Answer","text":"GHSA-f9fp-ghwv-vgqq (CVSS 7.5) affects setups where the Control Panel is reachable without authentication, which is the default in the dev and test environments when Micronaut Security is absent, or when micronaut.control-panel.security.access=ANONYMOUS is set. An attacker with network access, via DNS rebinding or a forged cross-site request, could run arbitrary SQL through the datasource panel and read datasource passwords and schema. Developers securing Micronaut apps can stay on top of advisories like this on daily.dev."}},{"@type":"Question","name":"What changed in Micronaut Core 5.2.20 related to configuration and environment handling?","acceptedAnswer":{"@type":"Answer","text":"Micronaut Core 5.2.20 fixes four configuration issues: property caches no longer hold a value read before a property source was added, placeholders in config import declarations are now resolved, environment refresh issues remaining after earlier 5.2.16-5.2.18 fixes are resolved, and ${random.*} values stay stable when a property source is processed. Developers debugging Micronaut config refresh issues can follow framework fixes like this on daily.dev."}}]} ```