Vulnerabilities

TI-2026-56237 CVE-2026-81515 · GHSA-hr73-3gpv-hh6q

Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)

MEDIUM 40

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00609 Published 2026-09-17 Fixed in 4.3.0 CWE-755

TI-2026-56238 CVE-2026-81516 · GHSA-67c9-f6v2-qv86

Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

MEDIUM 40

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00609 Published 2026-09-17 Fixed in 4.3.0 CWE-755

TI-2026-56482 CVE-2026-81868 · GHSA-5mq7-rwhj-4fh9

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

LOW 28

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0025 Published 2026-09-17 Fixed in 4.3.0 CWE-288

TI-2026-52881 CVE-2026-75523 · GHSA-8phw-xrj9-cpqp

Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

LOW 27

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00438 Published 2026-09-17 Fixed in 4.3.0 CWE-200

TI-2026-37011 CVE-2026-50268 · GHSA-4j9m-h44m-2hv8

Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding

LOW 9

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications.

CVSS 3.1LOW 1.9 Local High privileges No interaction EPSS 0.00047 Published 2026-06-17 Fixed in 4.2.0 CWE-256

TI-2026-37010 CVE-2026-50267 · GHSA-rxrh-4j9h-xgg9

Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

LOW 20

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications.

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00065 Published 2026-06-17 Fixed in 4.2.0 CWE-312

TI-2026-36961 CVE-2026-50202 · GHSA-7fqc-p256-7pwj

Steeltoe's static JWKS cache shared across schemes and never invalidated

LOW 28

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications.

CVSS 3.1MEDIUM 5.9 Network High privileges No interaction EPSS 0.0029 Published 2026-06-17 Fixed in 3.4.0, 4.2.0 CWE-668

TI-2026-36960 CVE-2026-50201 · GHSA-227r-jm2g-7cp4

Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

LOW 28

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00231 Published 2026-06-17 Fixed in 4.2.0, 3.4.0 CWE-269

TI-2026-36959 CVE-2026-50200 · GHSA-q62h-354g-5r85

Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

LOW 38

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00185 Published 2026-06-17 Fixed in 4.2.0, 3.4.0 CWE-200

TI-2026-36955 CVE-2026-50196 · GHSA-j8ph-6fxj-g533

Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

LOW 39

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00446 Published 2026-06-17 Fixed in 4.2.0, 3.4.0 CWE-20

TI-2026-36953 CVE-2026-50194 · GHSA-58f6-6rj2-3v8r

Steeltoe vulnerable to management-port isolation bypass via spoofed Host header

MEDIUM 41

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00238 Published 2026-06-17 Fixed in 4.2.0, 3.4.0 CWE-288

TI-2024-27048 CVE-2024-40636 · GHSA-vmcp-66r5-3pcp

Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness

MEDIUM 63

Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, appli…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00418 Published 2024-07-17 Fixed in 3.2.8 CWE-532

Vulnerabilities

Filters