Steeltoe - CraftedSignal Threat Feed

Steeltoe Host Header Bypass Vulnerability (CVE-2026-50194)

hello@craftedsignal.io — Fri, 03 Jul 2026 11:24:19 +0000

A critical vulnerability (CVE-2026-50194) in Steeltoe applications allows unauthenticated remote attackers to bypass port isolation for management endpoints. This flaw affects configurations where Management:Endpoints:Port is explicitly set to a port different from the application's primary listener. The middleware, intended to restrict access, incorrectly relies on the Host HTTP header rather than the actual network socket port. By crafting a request with a spoofed Host header specifying the management port, attackers can trick the application into granting access to all actuator endpoints. This enables unauthorized control, information disclosure, and potential configuration manipulation, making it a high-severity concern for organizations using vulnerable Steeltoe versions, specifically Steeltoe.Management.Endpoint up to 4.1.0 and Steeltoe.Management.EndpointCore versions between 3.2.2 and 3.3.0.

Attack Chain

Attacker identifies a publicly accessible Steeltoe application that is likely using management endpoints.
The target Steeltoe application is configured with Management:Endpoints:Port set to a port different from its main listener (e.g., application on 80/443, management on 8080).
Attacker crafts an HTTP request targeting the application's main listener port, typically 80 or 443.
The crafted request includes a spoofed Host HTTP header, setting its value to the application's domain combined with the configured Management:Endpoints:Port (e.g., Host: example.com:8080).
The request scheme (HTTP/HTTPS) matches the Management:Endpoints:SslEnabled setting of the application.
The Steeltoe middleware, upon receiving the request, evaluates the Host header for port isolation rather than the actual socket port the request arrived on.
The spoofed Host header causes the middleware to erroneously permit access as if the request originated on the designated management port.
Attacker gains unauthenticated access to all management actuator endpoints (e.g., /actuator/health, /actuator/env), enabling information disclosure or potential configuration changes.

Impact

The successful exploitation of CVE-2026-50194 grants unauthenticated remote attackers full access to Steeltoe's management actuator endpoints. This can lead to severe consequences, including sensitive information disclosure (e.g., environment variables, application configuration), arbitrary configuration modifications, and potentially remote code execution if certain actuators are exposed and misconfigured. While no specific victim count has been reported, any organization deploying Steeltoe applications with the described vulnerable configuration is at risk. The ease of exploitation via a simple HTTP header manipulation makes this a high-risk vulnerability for data exposure and unauthorized system control.

Recommendation

Immediately upgrade Steeltoe.Management.Endpoint to version 4.1.1 or higher, and Steeltoe.Management.EndpointCore to version 3.3.1 or higher, to address CVE-2026-50194.
Deploy the provided Sigma rule to your SIEM, tuning cs-host to match your expected application domain and monitoring for cs-uri-stem containing /actuator/ with unexpected port values in the Host header.
Implement explicit ASP.NET Core authorization (RequireAuthorization) on all sensitive actuator endpoints as a defense-in-depth measure, as recommended by the Steeltoe advisory.
Configure reverse proxies or load balancers in front of Steeltoe applications to strictly enforce expected Host header values, preventing clients from specifying arbitrary ports.

Steeltoe.Discovery.Eureka Deserialization Denial-of-Service (CVE-2026-50196)

hello@craftedsignal.io — Fri, 03 Jul 2026 11:23:15 +0000

The Steeltoe.Discovery.Eureka client contains a critical vulnerability, identified as CVE-2026-50196, that can lead to a complete service discovery outage. The flaw resides in the DataCenterInfo.FromJson method, which is responsible for deserializing service registry information. This method incorrectly throws an ArgumentException when it encounters any DataCenterInfo.name value other than "MyOwn" or "Amazon". Crucially, the valid "Netflix" value, specified in the Java Eureka standard, is unrecognized. This exception propagates through the entire registry deserialization chain and is silently swallowed by the client's periodic cache refresh task. Consequently, the Steeltoe client's local service registry remains permanently empty or stale, severing its ability to perform service lookups. This issue affects versions >= 4.0.0, <= 4.1.0 and versions <= 3.3.0 of the nuget/Steeltoe.Discovery.Eureka package. It matters for defenders because a single, legitimate registration by a Java or Spring service in a mixed environment can inadvertently trigger a widespread denial of service for all Steeltoe clients.

Attack Chain

A legitimate non-Steeltoe Eureka client (e.g., a Java or Spring Boot application) registers itself with a Eureka server.
The registering client sends its DataCenterInfo.name as "Netflix", which is a valid value according to the Java Eureka specification.
A Steeltoe Eureka client (using the vulnerable Steeltoe.Discovery.Eureka package) attempts to fetch the full service registry from the Eureka server via an HTTP GET request.
During the internal deserialization process of the fetched registry data, the Steeltoe client's DataCenterInfo.FromJson method encounters the "Netflix" value for DataCenterInfo.name.
The DataCenterInfo.FromJson method, which only recognizes "MyOwn" or "Amazon" as valid names, incorrectly throws an ArgumentException.
This ArgumentException propagates through the registry fetch process and is subsequently swallowed by the Steeltoe client's periodic cache refresh task.
The Steeltoe client's local service registry cache fails to populate or update, leading to a persistent empty or stale state.
Impact: All services relying on this Steeltoe client for service discovery experience a complete outage due to the inability to resolve service lookups, which persists until the triggering registration is removed.

Impact

The vulnerability results in a complete and persistent service discovery outage for all Steeltoe Eureka clients connected to the affected registry. New clients will start with an empty service registry, while running clients will cease to refresh their local cache, effectively rendering them unable to locate or communicate with other services. This outage is triggered by the presence of a single registration with an unrecognized DataCenterInfo.name (such as "Netflix", which is valid in Java Eureka). It can be inadvertently caused by legitimate Java or Spring services in a mixed environment, leading to widespread unavailability across microservice architectures until the problematic registration is manually removed from the Eureka server.

Recommendation

Prioritize upgrading all instances of Steeltoe.Discovery.Eureka to a patched version that addresses CVE-2026-50196.
If immediate upgrade is not possible, audit your Eureka registry for any registrations using DataCenterInfo.name values other than "MyOwn" or "Amazon", specifically "Netflix", and remove them.
In environments with mixed Java/Spring and Steeltoe Eureka clients, proactively audit for the presence of the Netflix data center type before deploying Steeltoe Eureka clients to prevent CVE-2026-50196 from being triggered.

Steeltoe Environment Actuator Vulnerability (CVE-2026-50200) Leaks Database Passwords

hello@craftedsignal.io — Fri, 03 Jul 2026 11:22:21 +0000

A significant vulnerability, identified as CVE-2026-50200, affects the Sanitizer component within the Environment actuator of Steeltoe applications, specifically Steeltoe.Management.Endpoint versions <= 4.1.0 and Steeltoe.Management.EndpointCore versions <= 3.3.0. This flaw allows sensitive connection string details, including embedded plaintext passwords and user credentials, to be exposed verbatim when the /actuator/env endpoint is accessed. The default sanitization rules fail to cover standard .NET ConnectionStrings: or Steeltoe Connectors' Steeltoe:Client::Default:ConnectionString patterns. This means that if env is exposed in Management:Endpoints:Actuator:Exposure:Include on standard deployments, or if accessed by an authenticated Cloud Foundry user with read_basic_data permissions via /cloudfoundryapplication/env, an attacker can retrieve critical database credentials, leading to direct access to backend databases and circumventing application-level security controls.

Attack Chain

Attacker conducts reconnaissance to identify a publicly accessible or internally exposed Steeltoe application endpoint, specifically targeting /actuator/env or /cloudfoundryapplication/env.
The attacker sends an unauthenticated (if publicly exposed) or authenticated (if Cloud Foundry with read_basic_data permissions) HTTP GET request to the identified /actuator/env or /cloudfoundryapplication/env endpoint.
The Steeltoe application's Environment actuator processes the request to display environment properties.
Due to the flaw in the Sanitizer component (CVE-2026-50200), configuration keys such as ConnectionStrings: or *:ConnectionString are not properly redacted.
The application returns the full, unsanitized connection string values, which include plaintext credentials like Password= or user:pass@host, in the HTTP response body.
The attacker extracts these sensitive database credentials from the response.
Using the obtained credentials, the attacker establishes a direct connection to the backend database.
The attacker can then perform data exfiltration, manipulation, or further persistence actions on the database, bypassing the application layer.

Impact

Organizations running vulnerable Steeltoe applications are at high risk of credential compromise and direct database access. If successfully exploited, this vulnerability allows attackers to retrieve plaintext database credentials from the /actuator/env endpoint. This direct access to databases, such as SQL Server, PostgreSQL, or MySQL, can lead to severe consequences including unauthorized data exfiltration, data tampering, service disruption, and potential lateral movement within the network. The scope of impact is broad, affecting any organization utilizing Steeltoe where the actuator environment endpoint is exposed, either intentionally or inadvertently, without proper sanitization or authorization.

Recommendation

Immediately upgrade nuget/Steeltoe.Management.Endpoint to version 4.1.1 or later, and nuget/Steeltoe.Management.EndpointCore to version 3.3.1 or later, to patch CVE-2026-50200.
If immediate upgrade is not possible, remove env from Management:Endpoints:Actuator:Exposure:Include in your application configuration to prevent access via the standard path.
As a defense-in-depth measure, add .*connectionstring.* to the KeysToSanitize list in your Steeltoe configuration to ensure these patterns are redacted.
Enforce strong authorization on all actuator endpoints to limit access to trusted personnel and systems, as described in the brief's attack chain.
Deploy the Detects CVE-2026-50200 Exploitation - Access to Steeltoe /actuator/env Sigma rule to your SIEM and tune for legitimate access patterns.