TI-2026-52881 Aliases CVE-2026-75523 GHSA-8phw-xrj9-cpqp

Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

LOW 27CWE-200Published 2026-09-17 · Updated 2026-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does not inspect query strings. When Management:Endpoints:HttpExchanges:IncludeQueryString is enabled, the HttpExchangeRequest response can disclose OAuth tokens, password-reset tokens, signed-URL signatures, API keys, and other query-string secrets from prior traffic to a caller that can reach the explicitly exposed endpoint. The Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logger also records these URIs, creating a second disclosure channel for users with log access. This issue is fixed in version 4.3.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00438 38th percentileScored 2026-11-07

Fix Fixed security-advisories (SteeltoeOSS): 4.3.0Steeltoe.Management.Endpoint (NuGet): 4.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SteeltoeOSS	security-advisories	before 4.3.0	4.3.0	Patch available	CNA
—	Steeltoe.Management.Endpoint (NuGet)	before 4.3.0	4.3.0	Patch available	GHSA-8phw-xrj9-cpqp

security-advisories VendorSteeltoeOSS Affected before 4.3.0 Fixed in 4.3.0 Patch available CNA
Steeltoe.Management.Endpoint (NuGet) Vendor— Affected before 4.3.0 Fixed in 4.3.0 Patch available GHSA-8phw-xrj9-cpqp

Remediation

Fix · CNA security-advisories (SteeltoeOSS) Fixed in 4.3.0
Fix · GHSA-8phw-xrj9-cpqp Steeltoe.Management.Endpoint (NuGet) Fixed in 4.3.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-75523
2026-10-03 Alias added: GHSA-8phw-xrj9-cpqp

References

Other 4

TI-2024-27048 Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness CVSS 3.1MEDIUM 5.3
TI-2026-36953 Steeltoe vulnerable to management-port isolation bypass via spoofed Host header CVSS 3.1HIGH 8.2
TI-2026-56238 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) CVSS 3.1HIGH 7.5
TI-2026-56237 Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) CVSS 3.1HIGH 7.5
TI-2026-36955 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch CVSS 3.1HIGH 7.5
TI-2026-36959 Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords CVSS 3.1HIGH 7.5

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences