CVE-2026-50196

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, `DataCenterInfo.FromJson` throws `ArgumentException` for any `name` value other than `"MyOwn"` or `"Amazon"`, despite the Java Eureka specification defining a third valid value: `"Netflix"`. The exception propagates through the entire registry deserialization chain and is swallowed by the periodic cache refresh task, leaving the local service registry permanently empty or stale. Versions 4.2.0 and 3.4.0 patch the issue. If an immediate upgrade is not possible, remove any registrations using unsupported `DataCenterInfo.name` values from the registry. In mixed Java/Spring and Steeltoe environments, audit for the `Netflix` data center type before deploying Steeltoe Eureka clients.

• CWE-20
• CWE-400

• https://github.com/SteeltoeOSS/Steeltoe/commit/b8ed8557bb595863e4f340051d16b26ba40a75f4
• https://github.com/SteeltoeOSS/Steeltoe/commit/c34a7399e808d0d11dd977460e81df1f2722df28
• https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-j8ph-6fxj-g533

Published

Jun 17, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50190Shaarli is a personal bookmarking service. Versions prior to…8.6
• CVE-2026-501914gaBoards is a boards system for realtime project management…8.8
• CVE-2026-50192Kerberos Agent is an open source video (surveillance) manage…6.9
• CVE-2026-50193jackson-databind contains the general-purpose data-binding f…7.5
• CVE-2026-50194Steeltoe is an open source project that provides a collectio…8.2
• CVE-2026-50195containerd is an open-source container runtime. Versions pri…9.9
• CVE-2026-50197Skipper is an HTTP router and reverse proxy for service comp…7.8
• CVE-2026-50198Wallos is an open-source, self-hostable personal subscriptio…4.3
• CVE-2026-50199Wallos is an open-source, self-hostable personal subscriptio…4.3
• CVE-2026-5020A vulnerability was detected in Totolink A3600R 4.1.2cu.5182…9.8
• CVE-2026-50200Steeltoe is an open source project that provides a collectio…7.5
• CVE-2026-50201Steeltoe is an open source project that provides a collectio…6.5