CVE-2026-50196: Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Synopsis

This is a denial-of-service vulnerability in Steeltoe.Discovery.Eureka, the .NET Eureka service-discovery client. An attacker reachable over the network, with no authentication required, can register a service using the valid but unhandled DataCenterInfo name value "Netflix", which causes the affected client's entire registry deserialization to throw an unhandled exception and silently empty the local service registry. Successful exploitation leaves the target Steeltoe Eureka client permanently blind to all registered services, disrupting routing and inter-service communication. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as fix versions 4.2.0 or 3.4.0 are published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Eureka server over the network to inject a registration with an unsupported DataCenterInfo name value.

• AuthenticationNot required

  No credentials or account are needed to register a service entry with the Eureka server.

• Victim interactionNot required

  No user or operator action is required; the poisoned registry entry is consumed automatically by the periodic cache refresh task.

• Attack complexityDetail

  The exploit is reliable and condition-free: injecting a "Netflix" DataCenterInfo name value consistently triggers the exception on every cache refresh cycle.

Blast Radius

• The affected Steeltoe Eureka client's local service registry is permanently emptied or left stale, preventing it from resolving any downstream service addresses.
• All inter-service calls that rely on the Eureka registry for endpoint discovery fail, effectively isolating the affected application from the rest of the service mesh.
• The exception is silently swallowed by the refresh task, so the outage is invisible in normal application logs without explicit monitoring of the Eureka client cache.