EUVD-2026-81899
GHSA-5mq7-rwhj-4fh9
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Unauthenticated network spoofing (AV:N/PR:N) but AC:H because the attacker must obtain a valid in-scope public cert and the deployment must lack trusted-proxy restriction; co-tenant access gives C:H, minor I:L, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies() and UseCertificateAuthorization() trust the public certificate supplied in the X-Client-Cert request header without proving possession of the corresponding private key. Common Cloud Foundry routers do not remove this header from inbound requests. When inbound requests are not restricted to a known trusted proxy source IP, an attacker who obtains the public certificate of an application instance in the target organization or space and can reach the application can spoof X-Client-Cert to bypass the SameOrg and SameSpace policies for the certificate validity period. This issue is fixed in version 4.3.0.
AnalysisAI
Authentication bypass in Steeltoe.Security.Authorization.Certificate (Steeltoe prior to 4.3.0) lets remote unauthenticated attackers spoof the X-Client-Cert header to defeat the SameOrg and SameSpace authorization policies, gaining access to resources belonging to another organization or space. The flaw is that AddOrgAndSpacePolicies() combined with UseCertificateAuthorization() trusts a client-supplied public certificate without verifying proof of possession of the matching private key, and common Cloud Foundry routers pass the header through to the application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a Steeltoe.Security.Authorization.Certificate deployment (prior to 4.3.0) configured with both AddOrgAndSpacePolicies() and UseCertificateAuthorization(); AND ingress that does NOT restrict inbound requests to a known trusted proxy source IP (so the client-supplied X-Client-Cert header is honored); AND the attacker must possess the public certificate of an application instance within the target organization/space and have network reachability to the app. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority authentication-bypass (CWE-288) rated CVSS 6.5 by the reporter (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N), and the vector is internally consistent with the description: exploitation is unauthenticated (PR:N) and network-reachable (AV:N) but carries high complexity (AC:H) because the attacker must first obtain the public certificate of an app instance in the target org/space AND the deployment must fail to restrict inbound requests to a trusted proxy source IP - a non-default hardening gap rather than an out-of-the-box condition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Steeltoe 4.3.0 - upgrade the Steeltoe.Security.Authorization.Certificate package to 4.3.0 or later per the vendor advisory at https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-5mq7-rwhj-4fh9 and the release at https://github.com/SteeltoeOSS/Steeltoe/releases/tag/4.3.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Changjetong T+ (through 16.x) has .NET deserialization RCE in an AjaxPro endpoint. Attacker-controlled JSON triggers des
SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.
SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL st
PowerDocu versions prior to 2.4.0 allow arbitrary .NET object instantiation and code execution through unsafe deserializ
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a net
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML
Asp.Net-Core-Inventory-Order-Management-System versions up to 9.20250118. contains a security vulnerability (CVSS 6.3).
Insecure .NET Remoting deserialization in Altec DocLink (Beyond Limits) 4.0.336.0. Exposed TCP endpoints allow unauthent
Microsoft Semantic Kernel SDK has a CVSS 9.9 path traversal vulnerability enabling AI agents to access arbitrary files o
Unauthenticated .NET Remoting endpoint in Calero VeraSMART before 2022 R1. TCP port 8001 exposes default Object URIs ena
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today