SteeltoeOSS
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| security-advisories | 5 | – | Sep 17, 2026 |
| Steeltoe.Management.Endpoint | 3 | – | Jun 17, 2026 |
| Steeltoe.Management.EndpointCore | 2 | – | Jun 17, 2026 |
| Steeltoe.Discovery.Eureka | 1 | – | Jun 17, 2026 |
| Steeltoe.Management.EndpointBase | 1 | – | Jun 17, 2026 |
| Steeltoe.Security.Authentication.CloudFoundryBase | 1 | – | Jun 17, 2026 |
| Steeltoe.Security.Authentication.JwtBearer | 1 | – | Jun 17, 2026 |
| Steeltoe.Security.Authentication.OpenIdConnect | 1 | – | Jun 17, 2026 |
| Steeltoe.Configuration.Abstractions | 1 | – | Jun 17, 2026 |
| Steeltoe.Configuration.Encryption | 1 | – | Jun 17, 2026 |
Exploited and recent CVEs
- CVE-2026-81515 Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) 0.6%
- CVE-2026-81516 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) 0.6%
- CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession 0.2%
- CVE-2026-75523 Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets 0.4%
- CVE-2026-50268 Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding <0.1%
- CVE-2026-50267 Steeltoe: TLS private keys written to /tmp with default permissions, never deleted <0.1%
- CVE-2026-50202 Steeltoe's static JWKS cache shared across schemes and never invalidated 0.3%
- CVE-2026-50202 Steeltoe's static JWKS cache shared across schemes and never invalidated 0.3%
- CVE-2026-50202 Steeltoe's static JWKS cache shared across schemes and never invalidated 0.3%
- CVE-2026-50201 Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission 0.2%
- CVE-2026-50201 Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission 0.2%
- CVE-2026-50200 Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords 0.2%
- CVE-2026-50200 Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords 0.2%
- CVE-2026-50196 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch 0.4%
- CVE-2026-50194 Steeltoe vulnerable to management-port isolation bypass via spoofed Host header 0.2%
- CVE-2026-50194 Steeltoe vulnerable to management-port isolation bypass via spoofed Host header 0.2%
- CVE-2024-40636 Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness 0.4%