CVE-2026-50194: Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
Summary
When Steeltoe management endpoints are configured to listen on an alternate port (Management:Endpoints:Port is configured), the middleware responsible for restricting access to the endpoints uses the Host HTTP header rather than the actual network socket port.
Impact
An unauthenticated remote attacker can reach every actuator endpoint using a specially crafted HTTP request.
Affected configuration
- The application's public port is accessible over from the network. - Management:Endpoints:Port is configured to a value different from the application's main listener port. - The request scheme matches Management:Endpoints:SslEnabled. For example, http when SslEnabled is false (the default), or https when SslEnabled is true.
Mitigations
If an immediate upgrade to a patched version is not possible:
- Add explicit ASP.NET Core authorization (RequireAuthorization) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation. - Configure the reverse proxy or load balancer to enforce the Host header value and prevent clients from setting an arbitrary port.
Other sources
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. When Steeltoe management endpoints versions 3.2.2 through 3.3.0 and 4.1.0 are configured to listen on an alternate port (Management:Endpoints:Port is configured), the middleware responsible for restricting access to the endpoints uses the Host HTTP header rather than the actual network socket port. Versions 3.4.0 and 4.2.0 patch the issue. If an immediate upgrade to a patched version is not possible, add explicit ASP.NET Core authorization (RequireAuthorization) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation and/or configure the reverse proxy or load balancer to enforce the Host header value and prevent clients from setting an arbitrary port.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/Steeltoe.Management.EndpointCoreto a version that resolves this vulnerability.Fixed in 3.4.0 - Upgrade
Upgrade
nuget/Steeltoe.Management.Endpointto a version that resolves this vulnerability.Fixed in 4.2.0 - Upgrade
Upgrade
Steeltoeto a version that resolves this vulnerability.Fixed in 3.4.0 - Upgrade
Upgrade
Steeltoeto a version that resolves this vulnerability.Fixed in 4.2.0 - Configuration
Add explicit ASP.NET Core authorization (RequireAuthorization) to all sensitive actuator endpoints as defense-in-depth, independent of port isolation.
Steeltoe management actuator endpoints (ASP.NET Core) RequireAuthorization = true - Configuration
Configure the reverse proxy or load balancer to enforce the Host header value and prevent clients from setting an arbitrary port.
Reverse proxy / load balancer Host header enforcement = enforced
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50194?
CVE-2026-50194 has a severity rating of high with a score of 8.2.
What versions are affected by CVE-2026-50194?
CVE-2026-50194 affects Steeltoe management endpoints versions 3.2.2 through 3.3.0 and 4.1.0.
How do I fix CVE-2026-50194?
To mitigate CVE-2026-50194, upgrade to a version of Steeltoe that is not vulnerable, specifically later than 4.1.0.
What is the vulnerability in CVE-2026-50194?
CVE-2026-50194 involves a management-port isolation bypass via a spoofed Host header in Steeltoe.
Who should be concerned about CVE-2026-50194?
Developers and organizations using vulnerable versions of Steeltoe for cloud-native application development should be concerned about CVE-2026-50194.