Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-288.
Summary
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. When Steeltoe management endpoints versions 3.2.2 through 3.3.0 and 4.1.0 are configured to listen on an alternate port (`Management:Endpoints:Port` is configured), the middleware responsible for restricting access to the endpoints uses the `Host` HTTP header rather than the actual network socket port. Versions 3.4.0 and 4.2.0 patch the issue. If an immediate upgrade to a patched version is not possible, add explicit ASP.NET Core authorization (`RequireAuthorization`) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation and/or configure the reverse proxy or load balancer to enforce the `Host` header value and prevent clients from setting an arbitrary port.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SteeltoeOSS | Steeltoe.Management.Endpoint | before 4.2.0 | 4.2.0 | Patch available | CNA |
| SteeltoeOSS | Steeltoe.Management.EndpointCore | 3.2.2 to before 3.4.0 | 3.4.0 | Patch available | CNA |
| — | Steeltoe.Management.Endpoint (NuGet) | before 4.2.0 | 4.2.0 | Patch available | GHSA-58f6-6rj2-3v8r |
| — | Steeltoe.Management.EndpointCore (NuGet) | 3.2.2 to before 3.4.0 | 3.4.0 | Patch available | GHSA-58f6-6rj2-3v8r |
- Steeltoe.Management.Endpoint VendorSteeltoeOSS Affected before 4.2.0 Fixed in 4.2.0 Patch available CNA
- Steeltoe.Management.EndpointCore VendorSteeltoeOSS Affected 3.2.2 to before 3.4.0 Fixed in 3.4.0 Patch available CNA
- Steeltoe.Management.Endpoint (NuGet) Vendor— Affected before 4.2.0 Fixed in 4.2.0 Patch available GHSA-58f6-6rj2-3v8r
- Steeltoe.Management.EndpointCore (NuGet) Vendor— Affected 3.2.2 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-58f6-6rj2-3v8r
Remediation
- Fix · CNA Steeltoe.Management.Endpoint (SteeltoeOSS) Fixed in 4.2.0
- Fix · CNA Steeltoe.Management.EndpointCore (SteeltoeOSS) Fixed in 3.4.0
- Fix · GHSA-58f6-6rj2-3v8r Steeltoe.Management.Endpoint (NuGet) Fixed in 4.2.0 Advisory →
- Fix · GHSA-58f6-6rj2-3v8r Steeltoe.Management.EndpointCore (NuGet) Fixed in 3.4.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-50194
- 2026-10-03 Alias added: GHSA-58f6-6rj2-3v8r
References
Other 4
- https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-58f6-6rj2-3v8r
- https://github.com/SteeltoeOSS/Steeltoe/commit/4cbc352fe89ac2e6c609554e435ab28996fec5e9
- https://github.com/SteeltoeOSS/Steeltoe/commit/b7ca93c510aaa08d7e4ebec40ce20c5811c2c4b6
- https://github.com/SteeltoeOSS/steeltoe
More SteeltoeOSS vulnerabilities
- TI-2024-27048 Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness CVSS 3.1MEDIUM 5.3
- TI-2026-56238 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) CVSS 3.1HIGH 7.5
- TI-2026-56237 Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) CVSS 3.1HIGH 7.5
- TI-2026-36955 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch CVSS 3.1HIGH 7.5
- TI-2026-36959 Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords CVSS 3.1HIGH 7.5
- TI-2026-56482 Steeltoe: Header-forwarded client cert lacks proof of private-key possession CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-50194 · CVE Program
- CVE-2026-50194 · NVD
- FIRST EPSS
- GHSA-58f6-6rj2-3v8r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences