# CVE-2026-50194: Steeltoe management port isolation bypass via spoofed Host header

Source: https://junglewise.ai/threats/cve-2026-50194-steeltoe-management-port-isolation-bypass-via-spoofed-host-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-50194 · Severity: high · CVSS 8.2 · Published 2026-06-17

Steeltoe is a set of libraries used to build cloud-native applications. A security flaw in its management component allows unauthorized users to bypass network restrictions intended to isolate sensitive administrative tools. By sending a specially crafted web request, an attacker could access internal management endpoints, potentially exposing sensitive application data or operational controls.

Technologies: [Steeltoe.Management.Endpoint (NuGet)](https://junglewise.ai/threats/technologies/nuget-steeltoe-management-endpoint), [SteeltoeOSS Steeltoe.Management.Endpoint](https://junglewise.ai/threats/technologies/steeltoe-management-endpoint), [SteeltoeOSS Steeltoe.Management.EndpointCore](https://junglewise.ai/threats/technologies/steeltoe-management-endpointcore). Vendors: [NuGet](https://junglewise.ai/threats/vendors/nuget), [SteeltoeOSS](https://junglewise.ai/threats/vendors/steeltoeoss).

## Quick answers

**Is CVE-2026-50194 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50194 being exploited in the wild.

**How severe is CVE-2026-50194?** High severity, with a CVSS score of 8.2, published 17 June 2026.

**Which products and versions are affected?** Steeltoe.Management.Endpoint (NuGet) ECOSYSTEM:introduced=0,fixed=4.2.0; Steeltoe.Management.EndpointCore (NuGet) ECOSYSTEM:introduced=3.2.2,fixed=3.4.0; SteeltoeOSS Steeltoe.Management.Endpoint <= 4.1.0; SteeltoeOSS Steeltoe.Management.EndpointCore >= 3.2.2, <= 3.3.0.

**Is there a fix for CVE-2026-50194?** Yes. Steeltoe.Management.Endpoint (NuGet): upgrade to 4.2.0 or later; Steeltoe.Management.EndpointCore (NuGet): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50194 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50194?** Check whether you run Steeltoe.Management.Endpoint (NuGet), Steeltoe.Management.EndpointCore (NuGet), SteeltoeOSS Steeltoe.Management.Endpoint or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Steeltoe.Management.Endpoint (NuGet): upgrade to 4.2.0 or later

  ```sh
  dotnet add package Steeltoe.Management.Endpoint --version 4.2.0
  ```

- Steeltoe.Management.EndpointCore (NuGet): upgrade to 3.4.0 or later

  ```sh
  dotnet add package Steeltoe.Management.EndpointCore --version 3.4.0
  ```


## Technical details

A vulnerability exists in Steeltoe's management endpoint middleware (CWE-288, CWE-639) where port isolation logic incorrectly relies on the HTTP 'Host' header instead of the actual network socket port. When 'Management:Endpoints:Port' is configured to a non-standard port, an unauthenticated remote attacker can bypass this restriction by spoofing the Host header in a request sent to the application's public port. This allows access to all actuator endpoints if the request scheme (HTTP/HTTPS) matches the 'SslEnabled' configuration. The issue is resolved in versions 4.2.0 and 3.4.0 by switching to 'HttpContext.Connection.LocalPort' for port validation.

## Affected products

- SteeltoeOSS Steeltoe.Management.Endpoint <= 4.1.0
- SteeltoeOSS Steeltoe.Management.EndpointCore >= 3.2.2, <= 3.3.0

## Identifiers

- CVE-2026-50194
- GHSA-58f6-6rj2-3v8r

## Timeline

- 2026-05-13: patched: Fix committed to repository
- 2026-05-29: disclosed: Initial advisory publication
- 2026-06-17: advisory: NVD publication
- 2026-07-02: advisory: GitHub Advisory Database publication

## References

- [https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-58f6-6rj2-3v8r](https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-58f6-6rj2-3v8r)
- [https://github.com/SteeltoeOSS/Steeltoe/commit/4cbc352fe89ac2e6c609554e435ab28996fec5e9](https://github.com/SteeltoeOSS/Steeltoe/commit/4cbc352fe89ac2e6c609554e435ab28996fec5e9)
- [https://github.com/SteeltoeOSS/Steeltoe/commit/b7ca93c510aaa08d7e4ebec40ce20c5811c2c4b6](https://github.com/SteeltoeOSS/Steeltoe/commit/b7ca93c510aaa08d7e4ebec40ce20c5811c2c4b6)
- [https://api.github.com/repos/SteeltoeOSS/security-advisories/security-advisories/GHSA-58f6-6rj2-3v8r](https://api.github.com/repos/SteeltoeOSS/security-advisories/security-advisories/GHSA-58f6-6rj2-3v8r)

## Related threats

- [Steeltoe Management.Endpoint HttpExchanges query-string secret exposure](https://junglewise.ai/threats/cve-2026-75523-steeltoe-management-endpoint-httpexchanges-query-string-secret)
- [Steeltoe Improper Authorization in Management Actuator Endpoints](https://junglewise.ai/threats/cve-2026-50201-steeltoe-improper-authorization-in-management-actuator-endpoints)
- [Steeltoe Management Endpoint information disclosure in Environment actuator](https://junglewise.ai/threats/cve-2026-50200-steeltoe-management-endpoint-information-disclosure-in)