CVE-2026-50194High· 8.2▾ TwilightSteeltoe vulnerable to management-port isolation bypass via spoofed Host header
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
When Steeltoe management endpoints are configured to listen on an alternate port (Management:Endpoints:Port is configured), the middleware responsible for restricting access to the endpoints uses the Host HTTP header rather than the actual network socket port.
An unauthenticated remote attacker can reach every actuator endpoint using a specially crafted HTTP request.
Management:Endpoints:Port is configured to a value different from the application's main listener port.Management:Endpoints:SslEnabled. For example, http when SslEnabled is false (the default), or https when SslEnabled is true.If an immediate upgrade to a patched version is not possible:
RequireAuthorization) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation.Host header value and prevent clients from setting an arbitrary port.Steeltoe.Management.Endpoint <= 4.1.0Steeltoe.Management.EndpointCore >= 3.2.2, <= 3.3.0Upgrade to a patched release:
Steeltoe.Management.Endpoint 4.2.0Steeltoe.Management.EndpointCore 3.4.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-75523Medium· 5.9Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications
CVE-2026-50200High· 7.5Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
CVE-2026-50201Medium· 6.5Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission
CVE-2021-46416High· 8.1Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.
CVE-2026-50196High· 7.5Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch
CVE-2026-50202Medium· 5.9Steeltoe's static JWKS cache shared across schemes and never invalidated