Executive brief
Steeltoe's Consul discovery client crashes when it encounters a malformed 'secure' metadata field on any registered service instance, making that entire service undiscoverable. An attacker with access to register services in the Consul catalog can exploit this to cause a service discovery outage affecting all applications that depend on that service.
Technical details
The vulnerability is a parsing error in Steeltoe.Discovery.Consul's handling of the 'secure' metadata field. The client uses `bool.Parse()` which throws an exception on any value other than the literal strings 'true' or 'false' (e.g., 'yes', '1', 'on'). When parsing service instances, a single malformed 'secure' value aborts construction of the entire instance list for that service, and when `GetAllInstancesAsync` is called, one malformed instance across any service can stop enumeration for all services. Attack preconditions require the attacker to have write access to the Consul service registration API. The vulnerability affects any Steeltoe application using `ConsulDiscoveryClient`, particularly in mixed-platform environments where non-.NET clients may register services with non-standard metadata values. A patch is expected to add validation or fallback handling for non-boolean values.
Affected products
- Steeltoe Steeltoe.Discovery.Consul <UNKNOWN>
Timeline
- 2026-09-17: disclosed
- advisory: CVE-2026-81516