PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50202 SteeltoeOSS CVE debrief

Steeltoe, an open-source project for building cloud-native applications, has a vulnerability in its JWT signing key cache. The `TokenKeyResolver` uses only the `kid` as the cache key without namespacing by authority. This allows a key fetched for one `JwtBearer` scheme to satisfy token validation for another, potentially bypassing security checks. The issue affects Steeltoe.Security.Authentication.CloudFoundryBase, Steeltoe.Security.Authentication.JwtBearer, and Steeltoe.Security.Authentication.OpenIdConnect before versions 3.4.0, 4.2.0, and 4.2.0 respectively. The vulnerability has a CVSS score of 5.9 and is considered medium severity

Vendor
SteeltoeOSS
Product
Steeltoe.Security.Authentication.CloudFoundryBase
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-22
Advisory published
2026-06-17
Advisory updated
2026-06-22

Who should care

Developers and administrators using Steeltoe for building cloud-native applications, especially those with multiple JwtBearer schemes pointing to different identity providers, should be aware of this vulnerability. Security teams responsible for monitoring and patching applications using Steeltoe should prioritize patching or mitigating this issue

Technical summary

The JWT signing key cache in `TokenKeyResolver` uses `kid` as the sole cache key without namespacing by authority. This causes issues in applications with multiple `JwtBearer` schemes pointing to different identity providers, as a key fetched for one scheme can satisfy token validation for another. Additionally, cached keys have no expiration, meaning rotated or revoked keys remain trusted until the application process restarts. The affected components are Steeltoe.Security.Authentication.CloudFoundryBase prior to version 3.4.0, Steeltoe.Security.Authentication.JwtBearer prior to version 4.2.0, and Steeltoe.Security.Authentication.OpenIdConnect prior to version 4.2.0

Defensive priority

Medium

Recommended defensive actions

  • Upgrade to Steeltoe.Security.Authentication.CloudFoundryBase version 3.4.0 or later
  • Upgrade to Steeltoe.Security.Authentication.JwtBearer version 4.2.0 or later
  • Upgrade to Steeltoe.Security.Authentication.OpenIdConnect version 4.2.0 or later
  • Configure only one JwtBearer scheme per application when different identity providers are required
  • Restart the application process after an identity provider signing key rotation to clear stale cached keys

Evidence notes

The information provided is based on the CVE record and NVD details. The vulnerability was published on 2026-06-17 and modified on 2026-06-18. References include commits and security advisories from the SteeltoeOSS GitHub repository

Sources and references

Verified primary and authoritative sources

  • CVE-2026-50202 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-50202

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-50202 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50202

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.