Access Control Vulnerability in Steeltoe Management Endpoints

CVE-2026-50194

What is CVE-2026-50194?

The Steeltoe project, which provides libraries for building cloud-native applications, has a vulnerability in its management endpoints. Specifically, if versions 3.2.2 through 3.3.0 and 4.1.0 are configured to listen on alternate ports, the access control middleware incorrectly utilizes the Host HTTP header instead of the actual network socket port. This flaw allows potential unauthorized access to sensitive actuator endpoints. Users are advised to upgrade to versions 3.4.0 or 4.2.0, which address this issue. As an additional security measure, implement explicit ASP.NET Core authorization for all sensitive endpoints and consider configuring a reverse proxy to enforce Host header validation to mitigate risks.

References