CVE-2026-50194

Name of the Vulnerable Software and Affected Versions Steeltoe versions 3.2.2 through 3.3.0 Steeltoe version 4.1.0

Description Steeltoe is an open source project providing libraries for building cloud-native applications. An issue exists where management endpoints, when configured to listen on an alternate port via the Management:Endpoints:Port configuration, allow access restriction bypass. This occurs because the middleware responsible for restricting access relies on the Host HTTP header instead of the actual network socket port.

Recommendations Update versions 3.2.2 through 3.3.0 to version 3.4.0. Update version 4.1.0 to version 4.2.0. Add explicit ASP.NET Core authorization (RequireAuthorization) to all sensitive actuator endpoints. Configure the reverse proxy or load balancer to enforce the Host header value to prevent clients from setting an arbitrary port.