DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-75523: CVE-2026-75523: Exposure of Sensitive Query Parameter Secrets in Steeltoe Actuator Endpoints

#security #cve #cybersecurity

CVE-2026-75523: Exposure of Sensitive Query Parameter Secrets in Steeltoe Actuator Endpoints

Vulnerability ID: CVE-2026-75523
CVSS Score: 5.9
Published: 2026-09-17

Steeltoe, a popular framework for building cloud-native .NET applications, contains a critical data-exposure flaw in its HttpExchanges actuator endpoint before version 4.3.0. When explicitly configured to include query strings, the system records and stores sensitive values (such as OAuth tokens and credentials) in memory and application debug logs without sanitization, exposing them to unauthorized network actors.

TL;DR

Unsanitized logging of request query parameters in Steeltoe's HttpExchanges actuator endpoint leaks secrets (OAuth tokens, API keys) in memory and debug log files to unauthorized actors.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-200, CWE-532
  • Attack Vector: Network
  • CVSS v3.1 Score: 5.9 (Medium)
  • Exploit Status: poc
  • CISA KEV Status: No
  • Attack Complexity: High
  • Impact: High (Information Disclosure)

Affected Systems

  • Applications utilizing the SteeltoeOSS Steeltoe framework specifically using Steeltoe.Management.Endpoint package versions prior to 4.3.0.
  • Steeltoe.Management.Endpoint: < 4.3.0 (Fixed in: 4.3.0)

Code Analysis

Commit: 9bf0ecb

Mask credentials in URI query strings for HTTP Exchanges Actuator

Mitigation Strategies

  • Upgrade the Steeltoe.Management.Endpoint package dependency to version 4.3.0 or later.
  • Disable query-string capture within the application configuration parameters if upgrading is not immediately viable.
  • Restrict network routing to actuator endpoints using security groups, reverse proxies, or internal API gateways.

Remediation Steps:

  1. Open your application's configuration file (e.g., appsettings.json).
  2. Locate the Management section and modify the HttpExchanges configuration to disable query-string inclusion: 'Management:Endpoints:HttpExchanges:IncludeQueryString = false'.
  3. Update your project file dependencies to reference Steeltoe version 4.3.0: ''.
  4. Rebuild the application and deploy the compiled assemblies to staging environments for regression testing.
  5. Review the production environment logger configuration to ensure that the logging level for 'Steeltoe.Management.Endpoint.Actuators.HttpExchanges' is restricted to 'Information' or 'Warning' rather than 'Debug' or 'Trace'.

References

Read the full report for CVE-2026-75523 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)