Steeltoe.Management.Endpoint <= 4.1.0 - CraftedSignal Threat Feed

Steeltoe Host Header Bypass Vulnerability (CVE-2026-50194)

hello@craftedsignal.io — Fri, 03 Jul 2026 11:24:19 +0000

A critical vulnerability (CVE-2026-50194) in Steeltoe applications allows unauthenticated remote attackers to bypass port isolation for management endpoints. This flaw affects configurations where Management:Endpoints:Port is explicitly set to a port different from the application's primary listener. The middleware, intended to restrict access, incorrectly relies on the Host HTTP header rather than the actual network socket port. By crafting a request with a spoofed Host header specifying the management port, attackers can trick the application into granting access to all actuator endpoints. This enables unauthorized control, information disclosure, and potential configuration manipulation, making it a high-severity concern for organizations using vulnerable Steeltoe versions, specifically Steeltoe.Management.Endpoint up to 4.1.0 and Steeltoe.Management.EndpointCore versions between 3.2.2 and 3.3.0.

Attack Chain

Attacker identifies a publicly accessible Steeltoe application that is likely using management endpoints.
The target Steeltoe application is configured with Management:Endpoints:Port set to a port different from its main listener (e.g., application on 80/443, management on 8080).
Attacker crafts an HTTP request targeting the application's main listener port, typically 80 or 443.
The crafted request includes a spoofed Host HTTP header, setting its value to the application's domain combined with the configured Management:Endpoints:Port (e.g., Host: example.com:8080).
The request scheme (HTTP/HTTPS) matches the Management:Endpoints:SslEnabled setting of the application.
The Steeltoe middleware, upon receiving the request, evaluates the Host header for port isolation rather than the actual socket port the request arrived on.
The spoofed Host header causes the middleware to erroneously permit access as if the request originated on the designated management port.
Attacker gains unauthenticated access to all management actuator endpoints (e.g., /actuator/health, /actuator/env), enabling information disclosure or potential configuration changes.

Impact

The successful exploitation of CVE-2026-50194 grants unauthenticated remote attackers full access to Steeltoe's management actuator endpoints. This can lead to severe consequences, including sensitive information disclosure (e.g., environment variables, application configuration), arbitrary configuration modifications, and potentially remote code execution if certain actuators are exposed and misconfigured. While no specific victim count has been reported, any organization deploying Steeltoe applications with the described vulnerable configuration is at risk. The ease of exploitation via a simple HTTP header manipulation makes this a high-risk vulnerability for data exposure and unauthorized system control.

Recommendation

Immediately upgrade Steeltoe.Management.Endpoint to version 4.1.1 or higher, and Steeltoe.Management.EndpointCore to version 3.3.1 or higher, to address CVE-2026-50194.
Deploy the provided Sigma rule to your SIEM, tuning cs-host to match your expected application domain and monitoring for cs-uri-stem containing /actuator/ with unexpected port values in the Host header.
Implement explicit ASP.NET Core authorization (RequireAuthorization) on all sensitive actuator endpoints as a defense-in-depth measure, as recommended by the Steeltoe advisory.
Configure reverse proxies or load balancers in front of Steeltoe applications to strictly enforce expected Host header values, preventing clients from specifying arbitrary ports.

Steeltoe Environment Actuator Vulnerability (CVE-2026-50200) Leaks Database Passwords

hello@craftedsignal.io — Fri, 03 Jul 2026 11:22:21 +0000

A significant vulnerability, identified as CVE-2026-50200, affects the Sanitizer component within the Environment actuator of Steeltoe applications, specifically Steeltoe.Management.Endpoint versions <= 4.1.0 and Steeltoe.Management.EndpointCore versions <= 3.3.0. This flaw allows sensitive connection string details, including embedded plaintext passwords and user credentials, to be exposed verbatim when the /actuator/env endpoint is accessed. The default sanitization rules fail to cover standard .NET ConnectionStrings: or Steeltoe Connectors' Steeltoe:Client::Default:ConnectionString patterns. This means that if env is exposed in Management:Endpoints:Actuator:Exposure:Include on standard deployments, or if accessed by an authenticated Cloud Foundry user with read_basic_data permissions via /cloudfoundryapplication/env, an attacker can retrieve critical database credentials, leading to direct access to backend databases and circumventing application-level security controls.

Attack Chain

Attacker conducts reconnaissance to identify a publicly accessible or internally exposed Steeltoe application endpoint, specifically targeting /actuator/env or /cloudfoundryapplication/env.
The attacker sends an unauthenticated (if publicly exposed) or authenticated (if Cloud Foundry with read_basic_data permissions) HTTP GET request to the identified /actuator/env or /cloudfoundryapplication/env endpoint.
The Steeltoe application's Environment actuator processes the request to display environment properties.
Due to the flaw in the Sanitizer component (CVE-2026-50200), configuration keys such as ConnectionStrings: or *:ConnectionString are not properly redacted.
The application returns the full, unsanitized connection string values, which include plaintext credentials like Password= or user:pass@host, in the HTTP response body.
The attacker extracts these sensitive database credentials from the response.
Using the obtained credentials, the attacker establishes a direct connection to the backend database.
The attacker can then perform data exfiltration, manipulation, or further persistence actions on the database, bypassing the application layer.

Impact

Organizations running vulnerable Steeltoe applications are at high risk of credential compromise and direct database access. If successfully exploited, this vulnerability allows attackers to retrieve plaintext database credentials from the /actuator/env endpoint. This direct access to databases, such as SQL Server, PostgreSQL, or MySQL, can lead to severe consequences including unauthorized data exfiltration, data tampering, service disruption, and potential lateral movement within the network. The scope of impact is broad, affecting any organization utilizing Steeltoe where the actuator environment endpoint is exposed, either intentionally or inadvertently, without proper sanitization or authorization.

Recommendation

Immediately upgrade nuget/Steeltoe.Management.Endpoint to version 4.1.1 or later, and nuget/Steeltoe.Management.EndpointCore to version 3.3.1 or later, to patch CVE-2026-50200.
If immediate upgrade is not possible, remove env from Management:Endpoints:Actuator:Exposure:Include in your application configuration to prevent access via the standard path.
As a defense-in-depth measure, add .*connectionstring.* to the KeysToSanitize list in your Steeltoe configuration to ensure these patterns are redacted.
Enforce strong authorization on all actuator endpoints to limit access to trusted personnel and systems, as described in the brief's attack chain.
Deploy the Detects CVE-2026-50200 Exploitation - Access to Steeltoe /actuator/env Sigma rule to your SIEM and tune for legitimate access patterns.