Steeltoe's static JWKS cache shared across schemes and never invalidated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Security.Authentication.CloudFoundryBase prior to version 3.4.0, Steeltoe.Security.Authentication.JwtBearer prior to version 4.2.0, and Steeltoe.Security.Authentication.OpenIdConnect prior to version 4.2.0, the JWT signing key cache in `TokenKeyResolver` uses `kid` as the sole cache key without namespacing by authority. In applications with multiple `JwtBearer` schemes pointing to different identity providers, a key fetched for one scheme can satisfy token validation for another. Additionally, cached keys have no expiration, so rotated or revoked keys remain trusted until the application process restarts. Steeltoe.Security.Authentication.CloudFoundryBase version 3.4.0, Steeltoe.Security.Authentication.JwtBearer version 4.2.0, and Steeltoe.Security.Authentication.OpenIdConnect version 4.2.0 patch the issue. If an immediate upgrade is not possible: In multi-scheme deployments, configure only one `JwtBearer` scheme per application when different identity providers are required; and/or restart the application process after an identity provider signing key rotation to clear stale cached keys.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SteeltoeOSS | Steeltoe.Security.Authentication.CloudFoundryBase | before 3.4.0 | 3.4.0 | Patch available | CNA |
| SteeltoeOSS | Steeltoe.Security.Authentication.JwtBearer | before 4.2.0 | 4.2.0 | Patch available | CNA |
| SteeltoeOSS | Steeltoe.Security.Authentication.OpenIdConnect | before 4.2.0 | 4.2.0 | Patch available | CNA |
| — | Steeltoe.Security.Authentication.JwtBearer (NuGet) | before 4.2.0 | 4.2.0 | Patch available | GHSA-7fqc-p256-7pwj |
| — | Steeltoe.Security.Authentication.OpenIdConnect (NuGet) | before 4.2.0 | 4.2.0 | Patch available | GHSA-7fqc-p256-7pwj |
| — | Steeltoe.Security.Authentication.CloudFoundryBase (NuGet) | before 3.4.0 | 3.4.0 | Patch available | GHSA-7fqc-p256-7pwj |
- Steeltoe.Security.Authentication.CloudFoundryBase VendorSteeltoeOSS Affected before 3.4.0 Fixed in 3.4.0 Patch available CNA
- Steeltoe.Security.Authentication.JwtBearer VendorSteeltoeOSS Affected before 4.2.0 Fixed in 4.2.0 Patch available CNA
- Steeltoe.Security.Authentication.OpenIdConnect VendorSteeltoeOSS Affected before 4.2.0 Fixed in 4.2.0 Patch available CNA
- Steeltoe.Security.Authentication.JwtBearer (NuGet) Vendor— Affected before 4.2.0 Fixed in 4.2.0 Patch available GHSA-7fqc-p256-7pwj
- Steeltoe.Security.Authentication.OpenIdConnect (NuGet) Vendor— Affected before 4.2.0 Fixed in 4.2.0 Patch available GHSA-7fqc-p256-7pwj
- Steeltoe.Security.Authentication.CloudFoundryBase (NuGet) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-7fqc-p256-7pwj
Remediation
- Fix · CNA Steeltoe.Security.Authentication.CloudFoundryBase (SteeltoeOSS) Fixed in 3.4.0
- Fix · CNA Steeltoe.Security.Authentication.JwtBearer (SteeltoeOSS) Fixed in 4.2.0
- Fix · CNA Steeltoe.Security.Authentication.OpenIdConnect (SteeltoeOSS) Fixed in 4.2.0
- Fix · GHSA-7fqc-p256-7pwj Steeltoe.Security.Authentication.JwtBearer (NuGet) Fixed in 4.2.0 Advisory →
- Fix · GHSA-7fqc-p256-7pwj Steeltoe.Security.Authentication.OpenIdConnect (NuGet) Fixed in 4.2.0 Advisory →
- Fix · GHSA-7fqc-p256-7pwj Steeltoe.Security.Authentication.CloudFoundryBase (NuGet) Fixed in 3.4.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-50202
- 2026-10-03 Alias added: GHSA-7fqc-p256-7pwj
References
Other 4
- https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-7fqc-p256-7pwj
- https://github.com/SteeltoeOSS/Steeltoe/commit/04db2ace3b806bfe0260bb7d4bda340f241eff48
- https://github.com/SteeltoeOSS/Steeltoe/commit/17b27b8be546ae3f83a2f6e91d45e0c84c5314b7
- https://github.com/SteeltoeOSS/security-advisories
More SteeltoeOSS vulnerabilities
- TI-2024-27048 Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness CVSS 3.1MEDIUM 5.3
- TI-2026-36953 Steeltoe vulnerable to management-port isolation bypass via spoofed Host header CVSS 3.1HIGH 8.2
- TI-2026-56238 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) CVSS 3.1HIGH 7.5
- TI-2026-56237 Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) CVSS 3.1HIGH 7.5
- TI-2026-36955 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch CVSS 3.1HIGH 7.5
- TI-2026-36959 Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords CVSS 3.1HIGH 7.5
Sources
- CVE-2026-50202 · CVE Program
- CVE-2026-50202 · NVD
- FIRST EPSS
- GHSA-7fqc-p256-7pwj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences