Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, the `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (`password`, `secret`, `key`, `token`, `.*credentials.*`, `vcap_services`) does not cover the standard .NET pattern `ConnectionStrings:<name>` or Steeltoe Connectors' `Steeltoe:Client:<type>:Default:ConnectionString`. There is no value-based scrubbing, so full connection string values including embedded `Password=` and `user:pass@host` segments are returned verbatim in `/actuator/env` responses. Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 patch the issue. If an immediate upgrade is not possible: On the standard path, remove `env` from the actuator exposure list; add `.*connectionstring.*` to `KeysToSanitize` as a defense-in-depth measure for both paths; and/or require authorization on actuator endpoints.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SteeltoeOSS | Steeltoe.Management.Endpoint | before 4.2.0 | 4.2.0 | Patch available | CNA |
| SteeltoeOSS | Steeltoe.Management.EndpointCore | before 3.4.0 | 3.4.0 | Patch available | CNA |
| — | Steeltoe.Management.Endpoint (NuGet) | before 4.2.0 | 4.2.0 | Patch available | GHSA-q62h-354g-5r85 |
| — | Steeltoe.Management.EndpointCore (NuGet) | before 3.4.0 | 3.4.0 | Patch available | GHSA-q62h-354g-5r85 |
- Steeltoe.Management.Endpoint VendorSteeltoeOSS Affected before 4.2.0 Fixed in 4.2.0 Patch available CNA
- Steeltoe.Management.EndpointCore VendorSteeltoeOSS Affected before 3.4.0 Fixed in 3.4.0 Patch available CNA
- Steeltoe.Management.Endpoint (NuGet) Vendor— Affected before 4.2.0 Fixed in 4.2.0 Patch available GHSA-q62h-354g-5r85
- Steeltoe.Management.EndpointCore (NuGet) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-q62h-354g-5r85
Remediation
- Fix · CNA Steeltoe.Management.Endpoint (SteeltoeOSS) Fixed in 4.2.0
- Fix · CNA Steeltoe.Management.EndpointCore (SteeltoeOSS) Fixed in 3.4.0
- Fix · GHSA-q62h-354g-5r85 Steeltoe.Management.Endpoint (NuGet) Fixed in 4.2.0 Advisory →
- Fix · GHSA-q62h-354g-5r85 Steeltoe.Management.EndpointCore (NuGet) Fixed in 3.4.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-50200
- 2026-10-03 Alias added: GHSA-q62h-354g-5r85
References
Other 4
- https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-q62h-354g-5r85
- https://github.com/SteeltoeOSS/Steeltoe/commit/bef9f14b710232fca3fbe87e48fdd1b9e6b60d43
- https://github.com/SteeltoeOSS/Steeltoe/commit/e50cd31a429b191841120f0d38fa9dda8f751b0a
- https://github.com/SteeltoeOSS/Steeltoe
More SteeltoeOSS vulnerabilities
- TI-2024-27048 Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness CVSS 3.1MEDIUM 5.3
- TI-2026-36953 Steeltoe vulnerable to management-port isolation bypass via spoofed Host header CVSS 3.1HIGH 8.2
- TI-2026-56238 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) CVSS 3.1HIGH 7.5
- TI-2026-56237 Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) CVSS 3.1HIGH 7.5
- TI-2026-36955 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch CVSS 3.1HIGH 7.5
- TI-2026-56482 Steeltoe: Header-forwarded client cert lacks proof of private-key possession CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-50200 · CVE Program
- CVE-2026-50200 · NVD
- FIRST EPSS
- GHSA-q62h-354g-5r85 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences