CVE-2026-50194: Steeltoe management port isolation bypass via spoofed Host header

CVE-2026-50194 · Severity: high · CVSS 8.2 · Published 2026-06-17

Steeltoe is a set of libraries used to build cloud-native applications. A security flaw in its management component allows unauthorized users to bypass network restrictions intended to isolate sensitive administrative tools. By sending a specially crafted web request, an attacker could access internal management endpoints, potentially exposing sensitive application data or operational controls.

Technologies: Steeltoe.Management.Endpoint (NuGet), SteeltoeOSS Steeltoe.Management.Endpoint, SteeltoeOSS Steeltoe.Management.EndpointCore. Vendors: NuGet, SteeltoeOSS.

Quick answers

Is CVE-2026-50194 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50194 being exploited in the wild.
How severe is CVE-2026-50194?
High severity, with a CVSS score of 8.2, published 17 June 2026.
Which products and versions are affected?
Steeltoe.Management.Endpoint (NuGet) ECOSYSTEM:introduced=0,fixed=4.2.0; Steeltoe.Management.EndpointCore (NuGet) ECOSYSTEM:introduced=3.2.2,fixed=3.4.0; SteeltoeOSS Steeltoe.Management.Endpoint <= 4.1.0; SteeltoeOSS Steeltoe.Management.EndpointCore >= 3.2.2, <= 3.3.0.
Is there a fix for CVE-2026-50194?
Yes. Steeltoe.Management.Endpoint (NuGet): upgrade to 4.2.0 or later; Steeltoe.Management.EndpointCore (NuGet): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50194 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50194?
Check whether you run Steeltoe.Management.Endpoint (NuGet), Steeltoe.Management.EndpointCore (NuGet), SteeltoeOSS Steeltoe.Management.Endpoint or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Steeltoe.Management.Endpoint (NuGet): upgrade to 4.2.0 or later
    dotnet add package Steeltoe.Management.Endpoint --version 4.2.0
  • Steeltoe.Management.EndpointCore (NuGet): upgrade to 3.4.0 or later
    dotnet add package Steeltoe.Management.EndpointCore --version 3.4.0

Technical details

A vulnerability exists in Steeltoe's management endpoint middleware (CWE-288, CWE-639) where port isolation logic incorrectly relies on the HTTP 'Host' header instead of the actual network socket port. When 'Management:Endpoints:Port' is configured to a non-standard port, an unauthenticated remote attacker can bypass this restriction by spoofing the Host header in a request sent to the application's public port. This allows access to all actuator endpoints if the request scheme (HTTP/HTTPS) matches the 'SslEnabled' configuration. The issue is resolved in versions 4.2.0 and 3.4.0 by switching to 'HttpContext.Connection.LocalPort' for port validation.

Affected products

  • SteeltoeOSS Steeltoe.Management.Endpoint <= 4.1.0
  • SteeltoeOSS Steeltoe.Management.EndpointCore >= 3.2.2, <= 3.3.0

Identifiers

  • CVE-2026-50194
  • GHSA-58f6-6rj2-3v8r

Timeline

  • 2026-05-13: patched: Fix committed to repository
  • 2026-05-29: disclosed: Initial advisory publication
  • 2026-06-17: advisory: NVD publication
  • 2026-07-02: advisory: GitHub Advisory Database publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.