Steeltoeoss vulnerabilities

Products

• Security-advisories 5
• Steeltoe.management.endpoint 3
• Steeltoe.management.endpointcore 2

Newest

• kiteworks security-advisories Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) CVE-2026-81515 Fix available 7.5 HighSeptember 17, 2026
• kiteworks security-advisories Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) CVE-2026-81516 Fix available 7.5 HighSeptember 17, 2026
• kiteworks security-advisories Steeltoe: Header-forwarded client cert lacks proof of private-key possession CVE-2026-81868 Fix available 6.5 MediumSeptember 17, 2026
• kiteworks security-advisories Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets CVE-2026-75523 Fix available 5.9 MediumSeptember 17, 2026
• steeltoeoss steeltoe.configuration.encryption Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding CVE-2026-50268 Fix available 1.9 LowJune 17, 2026
• steeltoeoss steeltoe.configuration.abstractions Steeltoe: TLS private keys written to /tmp with default permissions, never deleted CVE-2026-50267 Fix available 4.7 MediumJune 17, 2026
• steeltoeoss steeltoe.security.authentication.cloudfoundrybase, steeltoe.security.authentication.jwtbearer, steeltoe.security.authentication.openidconnect +2 more Steeltoe's static JWKS cache shared across schemes and never invalidated CVE-2026-50202 Fix available 5.9 MediumJune 17, 2026
• steeltoeoss steeltoe.management.endpoint, steeltoe.management.endpointbase +1 more Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission CVE-2026-50201 Fix available 6.5 MediumJune 17, 2026
• steeltoeoss steeltoe.management.endpoint, steeltoe.management.endpointcore +1 more Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords CVE-2026-50200 Fix available 7.5 HighJune 17, 2026
• steeltoeoss steeltoe.discovery.eureka Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch CVE-2026-50196 Fix available 7.5 HighJune 17, 2026
• steeltoeoss steeltoe.management.endpoint, steeltoe.management.endpointcore +1 more Steeltoe vulnerable to management-port isolation bypass via spoofed Host header CVE-2026-50194 Fix available 8.2 HighJune 17, 2026
• steeltoeoss discovery, kiteworks security-advisories +1 more Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness CVE-2024-40636 Fix available 5.3 MediumJuly 17, 2024