GHSA-58f6-6rj2-3v8r
Suggest an improvement- Source
- https://github.com/advisories/GHSA-58f6-6rj2-3v8r
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-58f6-6rj2-3v8r/GHSA-58f6-6rj2-3v8r.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-58f6-6rj2-3v8r
- Aliases
- Published
- 2026-07-02T20:29:13Z
- Modified
- 2026-07-02T20:45:11.884031243Z
- Severity
-
- 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
- Summary
- Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
- Details
-
Summary
When Steeltoe management endpoints are configured to listen on an alternate port (
Management:Endpoints:Portis configured), the middleware responsible for restricting access to the endpoints uses theHostHTTP header rather than the actual network socket port.Impact
An unauthenticated remote attacker can reach every actuator endpoint using a specially crafted HTTP request.
Affected configuration
- The application's public port is accessible over from the network.
Management:Endpoints:Portis configured to a value different from the application's main listener port.- The request scheme matches
Management:Endpoints:SslEnabled. For example,httpwhenSslEnabledisfalse(the default), orhttpswhenSslEnabledistrue.
Mitigations
If an immediate upgrade to a patched version is not possible:
- Add explicit ASP.NET Core authorization (
RequireAuthorization) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation. - Configure the reverse proxy or load balancer to enforce the
Hostheader value and prevent clients from setting an arbitrary port.
- Database specific
{ "cwe_ids": [ "CWE-288", "CWE-639" ], "github_reviewed": true, "severity": "HIGH", "github_reviewed_at": "2026-07-02T20:29:13Z", "nvd_published_at": "2026-06-17T22:16:23Z" }- References
-
- https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-58f6-6rj2-3v8r
- https://nvd.nist.gov/vuln/detail/CVE-2026-50194
- https://github.com/SteeltoeOSS/Steeltoe/commit/4cbc352fe89ac2e6c609554e435ab28996fec5e9
- https://github.com/SteeltoeOSS/Steeltoe/commit/b7ca93c510aaa08d7e4ebec40ce20c5811c2c4b6
- https://github.com/SteeltoeOSS/steeltoe
Affected packages
NuGet / Steeltoe.Management.Endpoint
Package
- Name
- Steeltoe.Management.Endpoint
- View open source insights on deps.dev
- Purl
- pkg:nuget/Steeltoe.Management.Endpoint
NuGet / Steeltoe.Management.EndpointCore
Package
- Name
- Steeltoe.Management.EndpointCore
- View open source insights on deps.dev
- Purl
- pkg:nuget/Steeltoe.Management.EndpointCore