Threat Intelligence Database

CVE-2026-50201 is a privilege management vulnerability in Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0. Sensitive actuator endpoints such as heap dump, environment, and thread dump do not enforce the higher 'read_sensitive_data' permission, instead defaulting to a lower permission level. This could allow users with lower privileges to access sensitive data. The issue is patched in Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0. Mitigation includes upgrading to these versions or explicitly setting required permissions for sensitive endpoints or limiting actuator registration.

Steeltoe.Management.Endpoint versions prior to 4.2.0 and Steeltoe.Management.EndpointCore versions prior to 3.4.0 contain a vulnerability where sensitive configuration values, such as connection strings with embedded passwords, are not properly redacted in the /actuator/env endpoint responses. This occurs because the default sanitization list does not cover common connection string patterns, exposing sensitive information to unauthorized actors. Versions 4.2.0 and 3.4.0 include patches to address this issue. Mitigations include upgrading to fixed versions, removing the env endpoint from actuator exposure, adding connection string patterns to the sanitization keys, and requiring authorization on actuator endpoints.

Steeltoe.Management.Endpoint versions 3.2.2, 3.3.0, and 4.1.0 contain an authentication bypass vulnerability when configured to listen on an alternate port. The middleware incorrectly uses the HTTP Host header instead of the actual network socket port to restrict access, allowing potential unauthorized access to management endpoints. Versions 3.4.0 and 4.2.0 address this issue. Mitigations include upgrading to patched versions or applying explicit ASP.NET Core authorization and configuring reverse proxies to validate the Host header.