Vendor
SteeltoeOSS
12 known vulnerabilities in products by SteeltoeOSS, 0 of them actively exploited (CISA KEV).
Key figures
12
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-81516 | Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) | 7.5 | |
| High | CVE-2026-81515 | Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) | 7.5 | |
| High | CVE-2026-50196 | Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch | 7.5 | |
| Medium | CVE-2026-75523 | Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets | 5.9 | |
| High | CVE-2026-50194 | Steeltoe vulnerable to management-port isolation bypass via spoofed Host header | 8.2 | |
| Medium | CVE-2026-81868 | Steeltoe: Header-forwarded client cert lacks proof of private-key possession | 6.5 | |
| High | CVE-2026-50200 | Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords | 7.5 | |
| Medium | CVE-2026-50201 | Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission | 6.5 | |
| Medium | CVE-2026-50202 | Steeltoe's static JWKS cache shared across schemes and never invalidated | 5.9 | |
| Medium | CVE-2024-40636 | SteeltoeOSS Security-advisories: Insertion of Sensitive Information into Log File | 5.3 | |
| Medium | CVE-2026-50267 | Steeltoe: TLS private keys written to /tmp with default permissions, never deleted | 4.7 | |
| Low | CVE-2026-50268 | Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding | 1.9 |
Products
| Security-advisories | 5 | 0 |
| SteeltoeOSS Steeltoe.Management.Endpoint | 3 | 0 |