TI-2026-56482 Aliases CVE-2026-81868 GHSA-5mq7-rwhj-4fh9

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

LOW 28CWE-288Published 2026-09-17 · Updated 2026-09-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass, Spoofing
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-288 and CWE-295.

Summary

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies() and UseCertificateAuthorization() trust the public certificate supplied in the X-Client-Cert request header without proving possession of the corresponding private key. Common Cloud Foundry routers do not remove this header from inbound requests. When inbound requests are not restricted to a known trusted proxy source IP, an attacker who obtains the public certificate of an application instance in the target organization or space and can reach the application can spoof X-Client-Cert to bypass the SameOrg and SameSpace policies for the certificate validity period. This issue is fixed in version 4.3.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0025 16th percentileScored 2026-11-07

Fix Fixed security-advisories (SteeltoeOSS): 4.3.0Steeltoe.Security.Authorization.Certificate (NuGet): 4.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SteeltoeOSS	security-advisories	before 4.3.0	4.3.0	Patch available	CNA
—	Steeltoe.Security.Authorization.Certificate (NuGet)	before 4.3.0	4.3.0	Patch available	GHSA-5mq7-rwhj-4fh9

security-advisories VendorSteeltoeOSS Affected before 4.3.0 Fixed in 4.3.0 Patch available CNA
Steeltoe.Security.Authorization.Certificate (NuGet) Vendor— Affected before 4.3.0 Fixed in 4.3.0 Patch available GHSA-5mq7-rwhj-4fh9

Remediation

Fix · CNA security-advisories (SteeltoeOSS) Fixed in 4.3.0
Fix · GHSA-5mq7-rwhj-4fh9 Steeltoe.Security.Authorization.Certificate (NuGet) Fixed in 4.3.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-81868
2026-10-03 Alias added: GHSA-5mq7-rwhj-4fh9

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-81868

Other 4

TI-2024-27048 Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness CVSS 3.1MEDIUM 5.3
TI-2026-36953 Steeltoe vulnerable to management-port isolation bypass via spoofed Host header CVSS 3.1HIGH 8.2
TI-2026-56238 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) CVSS 3.1HIGH 7.5
TI-2026-56237 Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) CVSS 3.1HIGH 7.5
TI-2026-36955 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch CVSS 3.1HIGH 7.5
TI-2026-36959 Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords CVSS 3.1HIGH 7.5

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences