# CVE-2026-50201: Steeltoe Improper Authorization in Management Actuator Endpoints

Source: https://junglewise.ai/threats/cve-2026-50201-steeltoe-improper-authorization-in-management-actuator-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-50201 · Severity: medium · CVSS 6.5 · Published 2026-06-17

Steeltoe is a framework used to build cloud-native .NET applications. A vulnerability in its management tools allows low-privileged users on Cloud Foundry to access sensitive diagnostic data, such as memory dumps and environment variables. This could lead to the exposure of database passwords, security tokens, and other confidential credentials, potentially allowing an attacker to gain deeper access to the organization's infrastructure.

Technologies: [Steeltoe.Management.Endpoint (NuGet)](https://junglewise.ai/threats/technologies/nuget-steeltoe-management-endpoint), [SteeltoeOSS Steeltoe.Management.Endpoint](https://junglewise.ai/threats/technologies/steeltoe-management-endpoint), [SteeltoeOSS Steeltoe.Management.EndpointCore](https://junglewise.ai/threats/technologies/steeltoe-management-endpointcore). Vendors: [NuGet](https://junglewise.ai/threats/vendors/nuget), [SteeltoeOSS](https://junglewise.ai/threats/vendors/steeltoeoss).

## Quick answers

**Is CVE-2026-50201 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50201 being exploited in the wild.

**How severe is CVE-2026-50201?** Medium severity, with a CVSS score of 6.5, published 17 June 2026.

**Which products and versions are affected?** Steeltoe.Management.Endpoint (NuGet) ECOSYSTEM:introduced=0,fixed=4.2.0; Steeltoe.Management.EndpointBase (NuGet) ECOSYSTEM:introduced=0,fixed=3.4.0; SteeltoeOSS Steeltoe.Management.Endpoint < 4.2.0, <= 4.1.0; SteeltoeOSS Steeltoe.Management.EndpointBase < 3.4.0, <= 3.3.0; and 1 more.

**Is there a fix for CVE-2026-50201?** Yes. Steeltoe.Management.Endpoint (NuGet): upgrade to 4.2.0 or later; Steeltoe.Management.EndpointBase (NuGet): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50201 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50201?** Check whether you run Steeltoe.Management.Endpoint (NuGet), Steeltoe.Management.EndpointBase (NuGet), SteeltoeOSS Steeltoe.Management.Endpoint or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Steeltoe.Management.Endpoint (NuGet): upgrade to 4.2.0 or later

  ```sh
  dotnet add package Steeltoe.Management.Endpoint --version 4.2.0
  ```

- Steeltoe.Management.EndpointBase (NuGet): upgrade to 3.4.0 or later

  ```sh
  dotnet add package Steeltoe.Management.EndpointBase --version 3.4.0
  ```


## Technical details

Steeltoe actuator endpoints default to 'EndpointPermissions.Restricted', which maps to Cloud Foundry's 'read_basic_data' permission. This level of access is granted to low-trust roles such as Space Auditors and Org Auditors. Sensitive endpoints—specifically heapdump, env, and thread dump—fail to require 'EndpointPermissions.Full' (mapped to 'read_sensitive_data'). Consequently, an authenticated attacker with basic auditor privileges can retrieve a heap dump containing in-memory secrets like database credentials and bearer tokens. The issue is resolved in Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointBase 3.4.0.

## Affected products

- SteeltoeOSS Steeltoe.Management.Endpoint <= 4.1.0
- SteeltoeOSS Steeltoe.Management.EndpointBase <= 3.3.0

## Identifiers

- CVE-2026-50201
- GHSA-227r-jm2g-7cp4

## Timeline

- 2026-05-29: disclosed
- 2026-06-17: advisory: NVD publication date
- 2026-07-02: patched: GitHub Advisory updated with patched versions

## References

- [https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-227r-jm2g-7cp4](https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-227r-jm2g-7cp4)
- [https://github.com/SteeltoeOSS/Steeltoe/commit/b39defa4db5f44f8696c456866b3a5b900d8d96b](https://github.com/SteeltoeOSS/Steeltoe/commit/b39defa4db5f44f8696c456866b3a5b900d8d96b)
- [https://github.com/SteeltoeOSS/Steeltoe/commit/da6c604decd992f61aeef763f5814102dcb088c7](https://github.com/SteeltoeOSS/Steeltoe/commit/da6c604decd992f61aeef763f5814102dcb088c7)
- [https://api.github.com/repos/SteeltoeOSS/security-advisories/security-advisories/GHSA-227r-jm2g-7cp4](https://api.github.com/repos/SteeltoeOSS/security-advisories/security-advisories/GHSA-227r-jm2g-7cp4)

## Related threats

- [Steeltoe Management.Endpoint HttpExchanges query-string secret exposure](https://junglewise.ai/threats/cve-2026-75523-steeltoe-management-endpoint-httpexchanges-query-string-secret)
- [Steeltoe Management Endpoint information disclosure in Environment actuator](https://junglewise.ai/threats/cve-2026-50200-steeltoe-management-endpoint-information-disclosure-in)
- [Steeltoe management port isolation bypass via spoofed Host header](https://junglewise.ai/threats/cve-2026-50194-steeltoe-management-port-isolation-bypass-via-spoofed-host-header)