SteeltoeOSS

6 results · Clear filters · Feed

• Medium 6.5
  CVE-2026-81868

  Steeltoe: Header-forwarded client cert lacks proof of private-key possession

  Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies() and UseCertificateAuthorization…

  SteeltoeOSS security-advisories Steeltoe.Security.Authorization.Certificate NuGet
  Sep 17, 2026
• Medium 5.9
  CVE-2026-75523

  Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

  Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, whic…

  SteeltoeOSS security-advisories Steeltoe.Management.Endpoint NuGet
  Sep 17, 2026
• Medium 4.7
  CVE-2026-50267

  Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

  Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstractions 4.0.0 through 4.1.0, when MySQL or PostgreSQL service bindings from `VCAP_SERVICES` include TLS…

  SteeltoeOSS Steeltoe.Configuration.Abstractions Steeltoe.Configuration.Abstractions NuGet
  Jun 17, 2026
• Medium 5.9
  CVE-2026-50202

  Steeltoe's static JWKS cache shared across schemes and never invalidated

  Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Security.Authentication.CloudFoundryBase prior to version 3.4.0, Steeltoe.Security.Authentication.JwtBearer prior to versi…

  SteeltoeOSS Steeltoe.Security.Authentication.JwtBearer Steeltoe.Security.Authentication.CloudFoundryBase Steeltoe.Security.Authentication.OpenIdConnect NuGet
  Jun 17, 2026
• Medium 6.5
  CVE-2026-50201

  Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

  Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, all Steeltoe actua…

  SteeltoeOSS Steeltoe.Management.Endpoint Steeltoe.Management.EndpointBase Steeltoe.Management.Endpoint NuGet
  Jun 17, 2026
• Medium 5.3
  CVE-2024-40636

  Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness

  Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utili…

  SteeltoeOSS security-advisories Steeltoe.Discovery.Eureka Steeltoe.Discovery.EurekaBase NuGet
  Jul 17, 2024