Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
Summary
When Steeltoe management endpoints are configured to listen on an alternate port (Management:Endpoints:Port is configured), the middleware responsible for restricting access to the endpoints uses the Host HTTP header rather than the actual network socket port.
Impact
An unauthenticated remote attacker can reach every actuator endpoint using a specially crafted HTTP request.
Affected configuration
- The application's public port is accessible over from the network.
Management:Endpoints:Portis configured to a value different from the application's main listener port.- The request scheme matches
Management:Endpoints:SslEnabled. For example,httpwhenSslEnabledisfalse(the default), orhttpswhenSslEnabledistrue.
Mitigations
If an immediate upgrade to a patched version is not possible:
- Add explicit ASP.NET Core authorization (
RequireAuthorization) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation. - Configure the reverse proxy or load balancer to enforce the
Hostheader value and prevent clients from setting an arbitrary port.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | Steeltoe.Management.Endpoint | < 4.2.0 | 4.2.0 |
| .NET (NuGet) | Steeltoe.Management.EndpointCore | >= 3.2.2, < 3.4.0 | 3.4.0 |
References
- https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-58f6-6rj2-3v8r
- https://nvd.nist.gov/vuln/detail/CVE-2026-50194
- https://github.com/SteeltoeOSS/Steeltoe/commit/4cbc352fe89ac2e6c609554e435ab28996fec5e9
- https://github.com/SteeltoeOSS/Steeltoe/commit/b7ca93c510aaa08d7e4ebec40ce20c5811c2c4b6
- https://github.com/SteeltoeOSS/steeltoe
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N- Weakness (CWE)
CWE-288, CWE-639- Platform
- .NET (NuGet)
- Package
Steeltoe.Management.Endpoint, Steeltoe.Management.EndpointCore- Disclosed
- 02.07.2026
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-58f6-6rj2-3v8r - CC BY 4.0
Vulnerability history: Steeltoe.Management.Endpoint
All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 07.2026 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 2
Disclosures per year
- 2026: 4
-
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.