TI-2026-37011 Aliases CVE-2026-50268 GHSA-4j9m-h44m-2hv8

Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding

LOW 9CWE-256Published 2026-06-17 · Updated 2026-06-18

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-256.

Summary

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encryption 4.0.0 through 4.1.0, configuring `encrypt:rsa:algorithm=OAEP` does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the `OAEP` setting selects PKCS#1 v1.5, which is the same algorithm as the `DEFAULT` setting. Steeltoe.Configuration.Encryption version 4.2.0 patches the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00047 0th percentileScored 2026-11-07

Fix Fixed Steeltoe.Configuration.Encryption (SteeltoeOSS): 4.2.0Steeltoe.Configuration.Encryption (NuGet): 4.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SteeltoeOSS	Steeltoe.Configuration.Encryption	4.0.0 to before 4.2.0	4.2.0	Patch available	CNA
—	Steeltoe.Configuration.Encryption (NuGet)	4.0.0 to before 4.2.0	4.2.0	Patch available	GHSA-4j9m-h44m-2hv8

Steeltoe.Configuration.Encryption VendorSteeltoeOSS Affected 4.0.0 to before 4.2.0 Fixed in 4.2.0 Patch available CNA
Steeltoe.Configuration.Encryption (NuGet) Vendor— Affected 4.0.0 to before 4.2.0 Fixed in 4.2.0 Patch available GHSA-4j9m-h44m-2hv8

Remediation

Fix · CNA Steeltoe.Configuration.Encryption (SteeltoeOSS) Fixed in 4.2.0
Fix · GHSA-4j9m-h44m-2hv8 Steeltoe.Configuration.Encryption (NuGet) Fixed in 4.2.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-50268
2026-10-03 Alias added: GHSA-4j9m-h44m-2hv8

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-50268

Other 3

TI-2024-27048 Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness CVSS 3.1MEDIUM 5.3
TI-2026-36953 Steeltoe vulnerable to management-port isolation bypass via spoofed Host header CVSS 3.1HIGH 8.2
TI-2026-56238 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) CVSS 3.1HIGH 7.5
TI-2026-56237 Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) CVSS 3.1HIGH 7.5
TI-2026-36955 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch CVSS 3.1HIGH 7.5
TI-2026-36959 Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords CVSS 3.1HIGH 7.5

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences