The vulnerability occurs when Steeltoe management endpoints, configured to use an alternate port, rely on the Host HTTP header for access restriction rather than the actual network socket. This misimplementation allows an attacker to forge a valid Host header and bypass port isolation, enabling unauthenticated access to sensitive actuator endpoints that may expose configuration data, logs, or operational diagnostics. The weakness is categorized as improper access control and privilege leakage, reflected by the CWE identifiers CWE-288 and CWE-639.

Steeltoe Open Source Software’s Steeltoe.Management.Endpoint and Steeltoe.Management.EndpointCore components are affected. Versions 3.2.2 through 3.3.0 and 4.1.0 are vulnerable to this host-header bypass; the issue was fixed in versions 3.4.0 and 4.2.0.

With a CVSS score of 8.2 the flaw is high severity, but the EPSS score is reported as less than 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires network reachability to the isolated port and the forgery of a Host header, the likely attack vector is remote network access, typically from unauthenticated clients attempting to consume management APIs.