What is the CVSS score of EUVD-2026-37801?

EUVD-2026-37801 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Steeltoe Management are affected by EUVD-2026-37801?

Steeltoe management endpoints in versions 3.2.2-3.3.0 and 4.1.0 contain an authentication bypass vulnerability that allows unauthenticated attackers to access sensitive information from isolated…. A patch is available.

How to fix or mitigate EUVD-2026-37801?

Within 24 hours: Identify all systems running Steeltoe versions 3.2.2-3.3.0 or 4.1.0 via configuration management and asset inventory. Within 7 days: Implement network ACLs to restrict management port access to authorized hosts only and deploy WAF rules to filter and validate Host headers. Within 30 days: Monitor vendor advisories for patch availability and plan immediate deployment to patched versions upon release.

Steeltoe Management EUVD-2026-37801

| CVE-2026-50194 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-17 GitHub_M

GHSA-58f6-6rj2-3v8r

Information Disclosure Steeltoe Management Endpoint Steeltoe Management Endpointcore Steeltoeoss

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Remote single-request Host-header spoof with no auth or UI; high confidentiality from actuator data exposure, low integrity from writable actuators, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 02, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Jun 17, 2026 - 22:15 vuln.today

Analysis Generated

Jun 17, 2026 - 22:15 vuln.today

DescriptionCVE.org

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. When Steeltoe management endpoints versions 3.2.2 through 3.3.0 and 4.1.0 are configured to listen on an alternate port (Management:Endpoints:Port is configured), the middleware responsible for restricting access to the endpoints uses the Host HTTP header rather than the actual network socket port. Versions 3.4.0 and 4.2.0 patch the issue. If an immediate upgrade to a patched version is not possible, add explicit ASP.NET Core authorization (RequireAuthorization) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation and/or configure the reverse proxy or load balancer to enforce the Host header value and prevent clients from setting an arbitrary port.

AnalysisAI

Improper authentication in Steeltoe management endpoints versions 3.2.2 through 3.3.0 and 4.1.0 allows remote unauthenticated attackers to reach actuator endpoints intended to be isolated on a separate management port by spoofing the HTTP Host header. The middleware trusted the client-supplied Host header port instead of the actual TCP socket port, defeating port-based access restrictions and enabling information disclosure from sensitive actuator endpoints. No public exploit identified at time of analysis, though the fix commit and a regression test demonstrating Host-header spoofing are publicly available on GitHub.

Technical ContextAI

Steeltoe is a .NET library suite that brings Spring-Boot-style cloud-native primitives - including management/actuator endpoints - to ASP.NET Core applications. The flaw lives in ManagementPortMiddleware.cs (EndpointCore), which gates actuator routes by comparing the request's port to the configured Management:Endpoints:Port value. The vulnerable code read context.Request.Host.Port, a value parsed from the inbound HTTP Host header and fully attacker-controllable, instead of context.Connection.LocalPort, the real Kestrel socket port. This is a textbook CWE-288 (Authentication Bypass Using an Alternate Path or Channel): a security decision is made on untrusted client-supplied input. The patch commits (4cbc352f and b7ca93c5) swap to Connection.LocalPort and add a regression test (AddAllActuators_WebApplication_IgnoresSpoofedHostHeader) that explicitly issues a Host: anything:9090 spoof against the public port and asserts a 404.

RemediationAI

Vendor-released patch: upgrade Steeltoe Management to 3.4.0 (3.x line) or 4.2.0 (4.x line), which replace the Host-header-port check with context.Connection.LocalPort per commits https://github.com/SteeltoeOSS/Steeltoe/commit/4cbc352fe89ac2e6c609554e435ab28996fec5e9 and https://github.com/SteeltoeOSS/Steeltoe/commit/b7ca93c510aaa08d7e4ebec40ce20c5811c2c4b6. If an immediate upgrade is not possible, the vendor advisory (https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-58f6-6rj2-3v8r) recommends two compensating controls: add explicit ASP.NET Core authorization via RequireAuthorization on every sensitive actuator endpoint so authentication - not port isolation - gates access (trade-off: requires an identity provider configured for actuators and may break monitoring tooling that scrapes anonymously), and/or configure the upstream reverse proxy or load balancer to strip or override the Host header so clients cannot supply an arbitrary port (trade-off: requires every ingress path to enforce the rule and may interfere with virtual-host routing).