CVE-2026-81868
MediumCVSS 6.5Summary
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies() and UseCertificateAuthorization() trust the public certificate supplied in the X-Client-Cert request header without proving possession of the corresponding private key. Common Cloud Foundry routers do not remove this header from inbound requests. When inbound requests are not restricted to a known trusted proxy source IP, an attacker who obtains the public certificate of an application instance in the target organization or space and can reach the application can spoof X-Client-Cert to bypass the SameOrg and SameSpace policies for the certificate validity period. This issue is fixed in version 4.3.0.
Risk Assessment
The risk is the possibility of bypassing certificate-based authorization policies, which could lead to unauthorized access to resources within an organization or space.
Recommendation
It is recommended to update Steeltoe to version 4.3.0 or later, which includes a fix for the issue. Additionally, restrict inbound requests to trusted proxy source IPs.
Other vulnerabilities in Steeltoe
See all- CVE-2026-81516High
Steeltoe in versions from 4.0.0 until 4.3.0, in ConsulDiscoveryClient, constructs ConsulServiceInstance objects by parsing each registration's secure metadata with a strict Boolean conversion. A principal that can register a Consul service can supply a secure value other than true or false, causing an exception that aborts construction of the entire instance list and makes the targeted service undiscoverable; when GetAllInstancesAsync enumerates all services, one malformed instance can abort enumeration across every service.
- CVE-2026-81515High
Steeltoe in versions from 4.0.0 until 4.3.0, in EurekaDiscoveryClient, deserializes the registry response as one unit, so an unrecognized actionType or status, a non-Boolean isCoordinatingDiscoveryServer, or a nonnumeric timestamp can abort the entire response. A principal that can register or update an instance can cause all connected Steeltoe clients to receive an empty or stale instance list until the malformed registration is removed.
- CVE-2026-75523Medium
In Steeltoe before version 4.3.0, the /actuator/httpexchanges endpoint masks only URI user information but does not inspect query strings. When IncludeQueryString is enabled, the response can disclose OAuth tokens, password-reset tokens, signed-URL signatures, API keys, and other query-string secrets from prior traffic. The endpoint's DEBUG logger also records these URIs, creating a second disclosure channel.
Original NVD description (English source)
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies() and UseCertificateAuthorization() trust the public certificate supplied in the X-Client-Cert request header without proving possession of the corresponding private key. Common Cloud Foundry routers do not remove this header from inbound requests. When inbound requests are not restricted to a known trusted proxy source IP, an attacker who obtains the public certificate of an application instance in the target organization or space and can reach the application can spoof X-Client-Cert to bypass the SameOrg and SameSpace policies for the certificate validity period. This issue is fixed in version 4.3.0.