Steeltoe.Security.Authorization.Certificate
Provides support for authorization with client certificates.
Activity
- Latest release
- 1mo ago
- Total releases
- 6
- Cadence
- ~4 months
- Last 12 months
- 3
Details
- License
- Apache-2.0
- First release
- Mar 04, 2025
| Version | Released | |
|---|---|---|
4.3.0
minor
|
4.3.0
minor
Dependencies (2)
|
|
4.2.0
minor
1 CVE
CVE-2026-81868
GHSA-5mq7-rwhj-4fh9
Sep 17, 2026
Steeltoe: Header-forwarded client cert lacks proof of private-key possession
6.5
/ 10
Medium
Network
High
None
None
Unchanged
High
Low
None
SummaryWhen Steeltoe's certificate-based authorization ( ImpactAn attacker who obtains the public certificate of an application instance in the target organization or space can spoof the Affected configuration
MitigationsIf an immediate upgrade to a patched version is not possible:
Affected versions
4.0.0
4.0.0-beta1
4.0.0-rc1
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Sep 17, 2026 · Source: OSV.dev |
4.2.0
minor
Dependencies (2)
|
|
4.1.0
minor
1 CVE
CVE-2026-81868
GHSA-5mq7-rwhj-4fh9
Sep 17, 2026
Steeltoe: Header-forwarded client cert lacks proof of private-key possession
6.5
/ 10
Medium
Network
High
None
None
Unchanged
High
Low
None
SummaryWhen Steeltoe's certificate-based authorization ( ImpactAn attacker who obtains the public certificate of an application instance in the target organization or space can spoof the Affected configuration
MitigationsIf an immediate upgrade to a patched version is not possible:
Affected versions
4.0.0
4.0.0-beta1
4.0.0-rc1
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Sep 17, 2026 · Source: OSV.dev |
4.1.0
minor
Dependencies (2)
|
|
4.0.0
initial
1 CVE
CVE-2026-81868
GHSA-5mq7-rwhj-4fh9
Sep 17, 2026
Steeltoe: Header-forwarded client cert lacks proof of private-key possession
6.5
/ 10
Medium
Network
High
None
None
Unchanged
High
Low
None
SummaryWhen Steeltoe's certificate-based authorization ( ImpactAn attacker who obtains the public certificate of an application instance in the target organization or space can spoof the Affected configuration
MitigationsIf an immediate upgrade to a patched version is not possible:
Affected versions
4.0.0
4.0.0-beta1
4.0.0-rc1
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Sep 17, 2026 · Source: OSV.dev |
4.0.0
initial
Dependencies (2)
|
|
4.0.0-rc1
pre
1 CVE
CVE-2026-81868
GHSA-5mq7-rwhj-4fh9
Sep 17, 2026
Steeltoe: Header-forwarded client cert lacks proof of private-key possession
6.5
/ 10
Medium
Network
High
None
None
Unchanged
High
Low
None
SummaryWhen Steeltoe's certificate-based authorization ( ImpactAn attacker who obtains the public certificate of an application instance in the target organization or space can spoof the Affected configuration
MitigationsIf an immediate upgrade to a patched version is not possible:
Affected versions
4.0.0
4.0.0-beta1
4.0.0-rc1
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Sep 17, 2026 · Source: OSV.dev |
4.0.0-rc1
pre
Dependencies (2)
|
|
4.0.0-beta1
pre
1 CVE
CVE-2026-81868
GHSA-5mq7-rwhj-4fh9
Sep 17, 2026
Steeltoe: Header-forwarded client cert lacks proof of private-key possession
6.5
/ 10
Medium
Network
High
None
None
Unchanged
High
Low
None
SummaryWhen Steeltoe's certificate-based authorization ( ImpactAn attacker who obtains the public certificate of an application instance in the target organization or space can spoof the Affected configuration
MitigationsIf an immediate upgrade to a patched version is not possible:
Affected versions
4.0.0
4.0.0-beta1
4.0.0-rc1
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Sep 17, 2026 · Source: OSV.dev |
4.0.0-beta1
pre
Dependencies (2)
|