Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

published 2026-09-17 53 d ago modified 2026-09-23 46 d ago also GHSA-8phw-xrj9-cpqp , EUVD-2026-81898

cvss: 5.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits: 0; none known

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does not inspect query strings. When Management:Endpoints:HttpExchanges:IncludeQueryString is enabled, the HttpExchangeRequest response can disclose OAuth tokens, password-reset tokens, signed-URL signatures, API keys, and other query-string secrets from prior traffic to a caller that can reach the explicitly exposed endpoint. The Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logger also records these URIs, creating a second disclosure channel for users with log access. This issue is fixed in version 4.3.0.

Patch / fix

fixed in 1 links 2

nuget Steeltoe.Management.Endpoint 4.3.0

github.com/SteeltoeOSS/Steeltoe@9bf0ecb commit
github.com/SteeltoeOSS/Steeltoe/releases/tag/4.3.0 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 53 d ago (2026-09-17)

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
nuget	Steeltoe.Management.Endpoint	<4.3.0	4.3.0

Affected products

SteeltoeOSS security-advisories

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary