CVE-2026-81868: Steeltoe: Header-forwarded client cert lacks proof of private-key possession

September 17, 2026

When Steeltoe’s certificate-based authorization (UseCertificateAuthorization) is configured, the default configuration of the middleware relies on the X-Client-Cert HTTP header to identify the client certificate, without verifying private-key possession. This header is not stripped by common Cloud Foundry routers (like Gorouter or Envoy) on inbound requests.

References

github.com/SteeltoeOSS/Steeltoe/commit/b626ef3d60aaf19c68eeeed5ee81045406c8c6d0
github.com/SteeltoeOSS/Steeltoe/releases/tag/4.3.0
github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-5mq7-rwhj-4fh9
github.com/advisories/GHSA-5mq7-rwhj-4fh9
nvd.nist.gov/vuln/detail/CVE-2026-81868

Code Behaviors & Features

Detect and mitigate CVE-2026-81868 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →