CVE-2026-50196

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, `DataCenterInfo.FromJson` throws `ArgumentException` for any `name` value other than `"MyOwn"` or `"Amazon"`, despite the Java Eureka specification defining a third valid value: `"Netflix"`. The exception propagates through the entire registry deserialization chain and is swallowed by the periodic cache refresh task, leaving the local service registry permanently empty or stale. Versions 4.2.0 and 3.4.0 patch the issue. If an immediate upgrade is not possible, remove any registrations using unsupported `DataCenterInfo.name` values from the registry. In mixed Java/Spring and Steeltoe environments, audit for the `Netflix` data center type before deploying Steeltoe Eureka clients.

• CWE-20
• CWE-400

• https://github.com/SteeltoeOSS/Steeltoe/commit/b8ed8557bb595863e4f340051d16b26ba40a75f4
• https://github.com/SteeltoeOSS/Steeltoe/commit/c34a7399e808d0d11dd977460e81df1f2722df28
• https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-j8ph-6fxj-g533

Published

Jun 17, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50188Kirby is an open-source content management system. Prior to …6.9
• CVE-2026-50189Appsmith is a platform to build admin panels, internal tools…7.2
• CVE-2026-5019A security vulnerability has been detected in code-projects …9.8
• CVE-2026-50193jackson-databind contains the general-purpose data-binding f…7.5
• CVE-2026-50194Steeltoe is an open source project that provides a collectio…8.2
• CVE-2026-50195containerd is an open-source container runtime. Versions pri…9.9
• CVE-2026-50197Skipper is an HTTP router and reverse proxy for service comp…7.8
• CVE-2026-5020A vulnerability was detected in Totolink A3600R 4.1.2cu.5182…9.8
• CVE-2026-50200Steeltoe is an open source project that provides a collectio…7.5
• CVE-2026-50201Steeltoe is an open source project that provides a collectio…6.5
• CVE-2026-50202Steeltoe is an open source project that provides a collectio…5.9
• CVE-2026-50203A path traversal in the SFTP provider (`SFTPHook.retrieve_di…9.1