CVE-2026-50194: Steeltoe vulnerable to management-port isolation bypass via spoofed Host header

Synopsis

This is an authentication bypass affecting Steeltoe management endpoint middleware (versions 3.2.2 through 3.3.0 and 4.1.0). The middleware that enforces port-based isolation reads the HTTP Host header instead of the actual network socket port, so a remote attacker with no credentials can send a spoofed Host header over the network and reach management actuator endpoints that were intended to be restricted to an alternate port. Successful exploitation lets an attacker read sensitive management data and make limited modifications to application state. No upstream fix versions have been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Steeltoe application over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials or account are needed; the spoofed Host header can be sent by any unauthenticated HTTP client.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from a user or administrator.

• Attack complexityDetail

  Attack complexity is low; the exploit is a straightforward header substitution with no race conditions or special environmental factors required.

Blast Radius

• An attacker reads responses from management actuator endpoints, which can expose environment variables, configuration values, health-check internals, and in-memory metrics.
• An attacker makes low-privilege writes to actuator endpoints that accept POST or DELETE requests, such as toggling log levels or refreshing configuration bindings.
• Internal service topology and dependency details visible through actuator endpoints can be harvested to plan further lateral movement within the deployment.