---
id: CVE-2026-50194
title: >-
  Steeltoe vulnerable to management-port isolation bypass via spoofed Host
  header
summary: >-
  Steeltoe vulnerable to management-port isolation bypass via spoofed Host
  header
severity: high
cvss: 8.2
cwe:
  - CWE-288
  - CWE-639
vendor: Steeltoe
product: Steeltoe.Management.Endpoint
ecosystem: nuget
affected:
  - Steeltoe.Management.Endpoint <= 4.1.0
  - 'Steeltoe.Management.EndpointCore >= 3.2.2, <= 3.3.0'
patched:
  - Steeltoe.Management.Endpoint 4.2.0
  - Steeltoe.Management.EndpointCore 3.4.0
published: '2026-07-02'
updated: '2026-07-02'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-58f6-6rj2-3v8r'
references:
  - url: >-
      https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-58f6-6rj2-3v8r
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50194'
  - url: >-
      https://github.com/SteeltoeOSS/Steeltoe/commit/4cbc352fe89ac2e6c609554e435ab28996fec5e9
  - url: >-
      https://github.com/SteeltoeOSS/Steeltoe/commit/b7ca93c510aaa08d7e4ebec40ce20c5811c2c4b6
  - url: 'https://github.com/advisories/GHSA-58f6-6rj2-3v8r'
tags:
  - ghsa
  - nuget
epss: 0.00414
epssPercentile: 0.33163
ingestedAt: '2026-07-02T20:42:45.638Z'
---

## Overview

### Summary

When Steeltoe management endpoints are configured to listen on an alternate port (`Management:Endpoints:Port` is configured), the middleware responsible for restricting access to the endpoints uses the `Host` HTTP header rather than the actual network socket port. 

### Impact

An unauthenticated remote attacker can reach every actuator endpoint using a specially crafted HTTP request.

### Affected configuration

- The application's public port is accessible over from the network.
- `Management:Endpoints:Port` is configured to a value different from the application's main listener port.
- The request scheme matches `Management:Endpoints:SslEnabled`. For example, `http` when `SslEnabled` is `false` (the default), or `https` when `SslEnabled` is `true`.

### Mitigations

If an immediate upgrade to a patched version is not possible:

- Add explicit ASP.NET Core authorization (`RequireAuthorization`) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation.
- Configure the reverse proxy or load balancer to enforce the `Host` header value and prevent clients from setting an arbitrary port.

## Affected packages

- `Steeltoe.Management.Endpoint <= 4.1.0`
- `Steeltoe.Management.EndpointCore >= 3.2.2, <= 3.3.0`

## Remediation

Upgrade to a patched release:

- `Steeltoe.Management.Endpoint 4.2.0`
- `Steeltoe.Management.EndpointCore 3.4.0`