5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-75523

CVE-2026-75523: Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does not inspect query strings. When Management:Endpoints:HttpExchanges:IncludeQueryString is enabled, the HttpExchangeRequest response can disclose OAuth tokens, password-reset tokens, signed-URL signatures, API keys, and other query-string secrets from prior traffic to a caller that can reach the explicitly exposed endpoint. The Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logger also records these URIs, creating a second disclosure channel for users with log access. This issue is fixed in version 4.3.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-75523

CVE-2026-75523:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Steeltoe.Management.Endpoint	nuget	<= 4.2.0	4.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2026-75523 in Steeltoe.Management.Endpoint arises from insufficient URI masking, specifically the failure to redact sensitive information present in query strings. The /actuator/httpexchanges endpoint, when exposed, records and displays request URIs. In the vulnerable versions (<= 4.2.0), the MaskedUri utility, intended for sanitization, only masked the UserInfo portion of the URI (username:password) but completely ignored query string parameters. This meant that any secrets passed in query strings (e.g., OAuth tokens, password-reset tokens) were stored and exposed verbatim.

The analysis of the provided commit 9bf0ecb9f2d4a34b65f61d41c5625d49071ae9fa reveals the specific functions modified to address this issue:

Steeltoe.Common.Extensions.MaskedUri.Mask: This is the core function responsible for performing the masking. The patch significantly modifies this function to include logic for identifying and redacting sensitive query string parameters based on a predefined list of keywords. In the vulnerable state, this function would return a URI with an unmasked query string.
Steeltoe.Management.Endpoint.Actuators.HttpExchanges.HttpExchangeRequest.HttpExchangeRequest (constructor): This constructor is responsible for creating HttpExchangeRequest objects, which encapsulate details of an HTTP exchange, including the URI. The patch modifies this constructor to explicitly call MaskedUri.Mask on the incoming Uri before storing it. In the vulnerable version, the Uri was stored without this crucial masking step, leading to the retention of sensitive query string data.
Steeltoe.Management.Endpoint.Actuators.HttpExchanges.HttpExchangeRequest.JsonUri: This property provides the string representation of the URI for JSON serialization. While the patch simplifies the getter, the vulnerability here stemmed from the fact that the Uri property itself (which this getter accesses) was not properly masked in the vulnerable version. Therefore, this property would expose the unmasked query string in the /actuator/httpexchanges response.
Steeltoe.Management.Endpoint.Actuators.HttpExchanges.HttpExchangesRepository.LogIncomingExchange: This method is used for logging HTTP exchange details. In the vulnerable version, it accepted a MaskedUri parameter. Since MaskedUri itself was not adequately masking query strings, this logging function would write sensitive query string parameters to application logs when DEBUG logging was enabled. The patch changes the parameter type to Uri, implying that the Uri passed to it will now be the fully masked one due to the changes in HttpExchangeRequest.

Exploitation would involve an attacker (or any authorized user) accessing the /actuator/httpexchanges endpoint. When this endpoint is called, the vulnerable functions would be invoked in the process of retrieving and displaying past HTTP requests. Specifically, HttpExchangeRequest would be constructed with an unmasked URI, its JsonUri property would expose this unmasked URI, and HttpExchangesRepository.LogIncomingExchange would log it. A runtime profiler would show calls to these functions, revealing the flow of unmasked sensitive data.

Vulnerable functions

Steeltoe.Common.Extensions.MaskedUri.Mask

src/Common/src/Common/Extensions/MaskedUri.cs

In the vulnerable version, the `Mask` method within the `MaskedUri` struct was designed to mask sensitive information in a URI but only implemented masking for the `UserInfo` portion (username and password). It failed to inspect and mask sensitive query string parameters. This allowed URIs containing secrets in their query strings to be processed and exposed without proper redaction. This function is directly responsible for the incomplete masking logic that leads to the vulnerability. When a URI is processed for masking, this function would be called, and in the vulnerable version, it would return an inadequately masked URI if sensitive data was in the query string. A profiler would show this function being called when a URI is being prepared for storage or display by the `httpexchanges` endpoint, and its output would contain the unmasked query string data. The change from `private` to `internal` also indicates it's now part of the public API for masking within the assembly, but the core change is the added query string masking logic. The vulnerable version of this function would be called by `HttpExchangeRequest` constructor and would return an unmasked URI if query string parameters were present and sensitive, thus directly contributing to the information leak. The `MaskedUri` type itself is a value type, and its `Mask` method is a static helper that returns a new `Uri` instance. The vulnerable behavior is that the returned `Uri` from this method would still contain sensitive query string data. Therefore, this function is a key point of vulnerability as it fails to perform the expected masking for query strings. The `MaskedUri` type is used to represent a URI that *should* be masked, and its `Mask` method is the primary mechanism for achieving this. The absence of query string masking in this method is the root cause of the data exposure through the `MaskedUri` abstraction itself. The `Mask` method is called by the `HttpExchangeRequest` constructor, which then stores the inadequately masked URI. Thus, any call to `HttpExchangeRequest`'s constructor would implicitly trigger the vulnerable behavior of `MaskedUri.Mask` if the URI contained sensitive query parameters. The profiler would show `Steeltoe.Common.Extensions.MaskedUri.Mask` being executed when a URI is being prepared for an HTTP exchange record, and its return value would be the unmasked URI.

Steeltoe.Management.Endpoint.Actuators.HttpExchanges.HttpExchangeRequest.HttpExchangeRequest

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

5.9

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-75523: Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

CVE-2026-75523:

5.9

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

CVE-2026-75523: Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Technical Details

5.9

5.9

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

5.9

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-75523: Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

CVE-2026-75523:

5.9

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

CVE-2026-75523: Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Technical Details

5.9

5.9

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI