CVE-2026-50196

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, `DataCenterInfo.FromJson` throws `ArgumentException` for any `name` value other than `"MyOwn"` or `"Amazon"`, despite the Java Eureka specification defining a third valid value: `"Netflix"`. The exception propagates through the entire registry deserialization chain and is swallowed by the periodic cache refresh task, leaving the local service registry permanently empty or stale. Versions 4.2.0 and 3.4.0 patch the issue. If an immediate upgrade is not possible, remove any registrations using unsupported `DataCenterInfo.name` values from the registry. In mixed Java/Spring and Steeltoe environments, audit for the `Netflix` data center type before deploying Steeltoe Eureka clients.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jun 17, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-501977.8Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silentlCVE-2026-501984.3Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inacCVE-2026-501994.3Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update_exchange.php loads CVE-2026-50209.8A vulnerability was detected in Totolink A3600R 4.1.2cu.5182_B20201102. Affected by this issue is the function setNoticeCfg of the file /cgiCVE-2026-502007.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.ManCVE-2026-502016.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.ManCVE-2026-502025.9Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.SecCVE-2026-502039.1A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote CVE-2026-502046.5Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because the secrets masker maCVE-2026-502058.2System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.CVE-2026-502066.8Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files.CVE-2026-502077.8The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disabl
CVE-2026-50196: High severity, CVSS 7.5 | Vulnix