Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation through the UseCertificateAuthorization flow in Authorization.Certificate, specifically the AddOrgAndSpacePolicies authorization path that trusts the X-Client-Cert header. An attacker can bypass SameOrg a...

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Summary When Steeltoe's certificate-based authorization UseCertificateAuthorization is configured, the default configuration of the middleware relies on the X-Client-Cert HTTP header to identify the client certificate, without verifying private-key possession. This header is not stripped by commo...

GHSA-5MQ7-RWHJ-4FH9 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Summary When Steeltoe's certificate-based authorization UseCertificateAuthorization is configured, the default configuration of the middleware relies on the X-Client-Cert HTTP header to identify the client certificate, without verifying private-key possession. This header is not stripped by commo...

CVE-2026-81868

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868

Steeltoe (open-source cloud-native application libraries) is vulnerable in Steeltoe.Security.Authorization.Certificate prior to version 4.3.0 . When using AddOrgAndSpacePolicies() and UseCertificateAuthorization(), the framework trusts the public certificate supplied in the X-Client-Cert request ...

EUVD-2026-81899

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...

PT-2026-94384

Name of the Vulnerable Software and Affected Versions Steeltoe versions prior to 4.3.0 Description Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate provided in the X-Client-Cert request header without...

CVE-2026-81868: Authentication Bypass Using an Alternate Path or Channel

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies and UseCertificateAuthorization trust the public certificate supplied i...