CVE-2026-75523: 
C# vulnerability analysis and mitigation

CVE-2026-75523 is an information disclosure vulnerability in Steeltoe's Steeltoe.Management.Endpoint NuGet package, specifically affecting the /actuator/httpexchanges actuator endpoint. The MaskedUri class used to sanitize recorded request URIs masks only the UserInfo (inline user:password@host) portion and fails to inspect or redact query strings, allowing secrets such as OAuth tokens, password-reset tokens, signed-URL signatures, and API keys to be returned verbatim in endpoint responses. All versions up to and including 4.2.0 are affected; the issue is fixed in version 4.3.0. It carries a CVSS v3.1 base score of 5.9 (Medium) (Github Advisory, Steeltoe Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The MaskedUri struct in src/Common/src/Common/Extensions/MaskedUri.cs applied masking only to the UserInfo component of a URI; when Management:Endpoints:HttpExchanges:IncludeQueryString is enabled (which is the default), the full query string — including sensitive parameters — was passed through unmodified and serialized into the uri field of HttpExchangeRequest responses. A second disclosure channel exists via the Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logger, which also logged these unmasked URIs. Exploitation requires that the attacker can reach the explicitly exposed /actuator/httpexchanges endpoint (which is not included in the exposure list by default) or has access to application debug logs (Github Advisory, Steeltoe Commit).

Successful exploitation results in high confidentiality impact with no integrity or availability impact. An attacker who can reach the /actuator/httpexchanges endpoint can retrieve full request URIs from prior application traffic, potentially exposing OAuth access tokens, password-reset links, signed-URL signatures, and API keys that were passed as query parameters by legitimate users. Additionally, any user with access to application debug logs can extract the same secrets from the Steeltoe.Management.Endpoint.Actuators.HttpExchanges logger output, creating a secondary insider-threat exposure channel. Harvested tokens could be used for account takeover, unauthorized API access, or lateral movement within connected systems (Github Advisory, Steeltoe Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is rated as high complexity because it requires the attacker to reach the non-default /actuator/httpexchanges endpoint, which must be explicitly added to the actuator exposure list by the application operator (Github Advisory).

1. Reconnaissance: Identify target applications using Steeltoe.Management.Endpoint versions ≤ 4.2.0 by probing common actuator paths (e.g., /actuator) or inspecting HTTP response headers and error messages for Steeltoe version indicators.
2. Verify endpoint exposure: Send a GET request to /actuator/httpexchanges on the target host. If the endpoint is exposed and returns HTTP 200 with JSON data, the application has explicitly added httpexchanges to its actuator exposure list.
3. Retrieve recorded exchanges: Parse the JSON response from /actuator/httpexchanges, focusing on the request.uri field of each recorded exchange entry.
4. Extract secrets from query strings: Inspect the uri values for sensitive query parameters such as access_token, token, api_key, password, sig, auth_code, or similar, which will appear in plaintext due to the missing query-string masking.
5. Exploit harvested credentials: Use extracted OAuth tokens, API keys, or signed URLs to authenticate to downstream services, reset user accounts, or access protected resources before the tokens expire (Github Advisory, Steeltoe Advisory).

• Network: Unexpected or repeated GET requests to /actuator/httpexchanges from external or untrusted IP addresses; automated scanning patterns targeting actuator endpoints (e.g., sequential probing of /actuator/* paths).
• Logs: Application debug logs containing the Steeltoe.Management.Endpoint.Actuators.HttpExchanges logger namespace with URIs that include sensitive query parameters (e.g., token=, api_key=, access_token=, sig=) in plaintext; access log entries for /actuator/httpexchanges from unexpected sources.
• Application Behavior: Downstream service alerts for token reuse from unexpected IP addresses or geographic locations shortly after the actuator endpoint was accessed; password-reset tokens being consumed without corresponding user-initiated resets.

Upgrade Steeltoe.Management.Endpoint to version 4.3.0, which extends MaskedUri to detect and redact sensitive query string parameters (matching names containing pass, pwd, key, token, bearer, secret, auth, cred, sig, hash, pin, otp, nonce, or cert) in both endpoint responses and debug logs (Steeltoe Release). If an immediate upgrade is not possible, apply the following workarounds:

• Remove httpexchanges from Management:Endpoints:Web:Exposure:Include to disable the endpoint entirely, or restrict it behind authentication.
• Set Management:Endpoints:HttpExchanges:IncludeQueryString to false to prevent query strings from being recorded.
• Restrict DEBUG-level logging for the Steeltoe.Management.Endpoint.Actuators.HttpExchanges namespace to authorized personnel only (Github Advisory).