---
id: CVE-2026-75523
title: >-
  Steeltoe is an open source project that provides a collection of libraries
  that helps users build cloud-native applications
summary: >-
  Steeltoe is an open source project that provides a collection of libraries
  that helps users build cloud-native applications. Prior to 4.3.0, the
  Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded
  request URIs t…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
vendor: Steeltoe
product: Steeltoe.Management.Endpoint
affected:
  - Steeltoe.Management.Endpoint <= 4.2.0
patched:
  - Steeltoe.Management.Endpoint 4.3.0
published: '2026-09-17'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:12:04.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75523'
references:
  - url: >-
      https://github.com/SteeltoeOSS/Steeltoe/commit/9bf0ecb9f2d4a34b65f61d41c5625d49071ae9fa
    label: security-advisories@github.com
  - url: 'https://github.com/SteeltoeOSS/Steeltoe/releases/tag/4.3.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-8phw-xrj9-cpqp
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-8phw-xrj9-cpqp'
tags:
  - nvd
  - ghsa
  - nuget
  - cve.org
epss: 0.00438
epssPercentile: 0.3543
aliases:
  - GHSA-8phw-xrj9-cpqp
ecosystem: nuget
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T17:23:43.488927Z'
ingestedAt: '2026-09-17T16:21:47.709Z'
---

## Overview

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does not inspect query strings. When Management:Endpoints:HttpExchanges:IncludeQueryString is enabled, the HttpExchangeRequest response can disclose OAuth tokens, password-reset tokens, signed-URL signatures, API keys, and other query-string secrets from prior traffic to a caller that can reach the explicitly exposed endpoint. The Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logger also records these URIs, creating a second disclosure channel for users with log access. This issue is fixed in version 4.3.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-75523)

Affected packages:

- `Steeltoe.Management.Endpoint <= 4.2.0`

Patched in:

- `Steeltoe.Management.Endpoint 4.3.0`

Source: https://github.com/advisories/GHSA-8phw-xrj9-cpqp