Executive brief
Steeltoe is a set of libraries used to build cloud-native applications. A security flaw in its management component allows unauthorized users to bypass network restrictions intended to isolate sensitive administrative tools. By sending a specially crafted web request, an attacker could access internal management endpoints, potentially exposing sensitive application data or operational controls.
Technical details
A vulnerability exists in Steeltoe's management endpoint middleware (CWE-288, CWE-639) where port isolation logic incorrectly relies on the HTTP 'Host' header instead of the actual network socket port. When 'Management:Endpoints:Port' is configured to a non-standard port, an unauthenticated remote attacker can bypass this restriction by spoofing the Host header in a request sent to the application's public port. This allows access to all actuator endpoints if the request scheme (HTTP/HTTPS) matches the 'SslEnabled' configuration. The issue is resolved in versions 4.2.0 and 3.4.0 by switching to 'HttpContext.Connection.LocalPort' for port validation.
Affected products
- SteeltoeOSS Steeltoe.Management.Endpoint <= 4.1.0
- SteeltoeOSS Steeltoe.Management.EndpointCore >= 3.2.2, <= 3.3.0
Timeline
- 2026-05-13: patched: Fix committed to repository
- 2026-05-29: disclosed: Initial advisory publication
- 2026-06-17: advisory: NVD publication
- 2026-07-02: advisory: GitHub Advisory Database publication
References
- https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-58f6-6rj2-3v8r
- https://github.com/SteeltoeOSS/Steeltoe/commit/4cbc352fe89ac2e6c609554e435ab28996fec5e9
- https://github.com/SteeltoeOSS/Steeltoe/commit/b7ca93c510aaa08d7e4ebec40ce20c5811c2c4b6
- https://api.github.com/repos/SteeltoeOSS/security-advisories/security-advisories/GHSA-58f6-6rj2-3v8r