---
id: CVE-2026-81868
title: >-
  Steeltoe is an open source project that provides a collection of libraries
  that helps users build cloud-native applications
summary: >-
  Steeltoe is an open source project that provides a collection of libraries
  that helps users build cloud-native applications. Prior to 4.3.0,
  Steeltoe.Security.Authorization.Certificate deployments using
  AddOrgAndSpacePolicies() and UseCe…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-288
  - CWE-295
vendor: SteeltoeOSS
product: security-advisories
affected:
  - security-advisories < 4.3.0
patched:
  - Steeltoe.Security.Authorization.Certificate 4.3.0
published: '2026-09-17'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T19:19:33.167'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81868'
references:
  - url: >-
      https://github.com/SteeltoeOSS/Steeltoe/commit/b626ef3d60aaf19c68eeeed5ee81045406c8c6d0
    label: security-advisories@github.com
  - url: 'https://github.com/SteeltoeOSS/Steeltoe/releases/tag/4.3.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-5mq7-rwhj-4fh9
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81868'
  - url: 'https://github.com/advisories/GHSA-5mq7-rwhj-4fh9'
tags:
  - nvd
  - cve.org
  - ghsa
  - nuget
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-23T18:32:10.341865Z'
epss: 0.0025
epssPercentile: 0.14592
aliases:
  - GHSA-5mq7-rwhj-4fh9
ecosystem: nuget
ingestedAt: '2026-09-17T16:21:47.711Z'
---

## Overview

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies() and UseCertificateAuthorization() trust the public certificate supplied in the X-Client-Cert request header without proving possession of the corresponding private key. Common Cloud Foundry routers do not remove this header from inbound requests. When inbound requests are not restricted to a known trusted proxy source IP, an attacker who obtains the public certificate of an application instance in the target organization or space and can reach the application can spoof X-Client-Cert to bypass the SameOrg and SameSpace policies for the certificate validity period. This issue is fixed in version 4.3.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-81868)

Affected packages:

- `Steeltoe.Security.Authorization.Certificate <= 4.2.0`

Patched in:

- `Steeltoe.Security.Authorization.Certificate 4.3.0`

Source: https://github.com/advisories/GHSA-5mq7-rwhj-4fh9