CVE-2026-50200 affects Steeltoe.Management.Endpoint prior to 4.2.0 and Steeltoe.Management.EndpointCore prior to 3.4.0. The Sanitizer component in the Environment actuator redacts configuration values based on key name suffix matching but does not cover .NET standard connection string patterns or Steeltoe Connectors' connection string keys. As a result, sensitive connection string values containing passwords or credentials are returned in plaintext in /actuator/env responses. This exposure of sensitive information (CWE-200) can lead to unauthorized access. The issue is patched in versions 4.2.0 and 3.4.0. If upgrading is not immediately possible, mitigations include removing the env endpoint from exposure, extending the KeysToSanitize list with connection string patterns, and enforcing authorization on actuator endpoints.

The vulnerability allows unauthorized actors to obtain sensitive configuration data, including full connection strings with embedded passwords, from the /actuator/env endpoint. This exposure can lead to compromise of credentials and unauthorized access to backend systems or databases. The CVSS score is 7.5 (high severity), indicating a network exploitable vulnerability with high impact on confidentiality but no impact on integrity or availability.

A fix is available in Steeltoe.Management.Endpoint version 4.2.0 and Steeltoe.Management.EndpointCore version 3.4.0. Users should upgrade to these versions to remediate the vulnerability. If immediate upgrade is not possible, mitigate by removing the 'env' endpoint from the actuator exposure list, adding '.*connectionstring.*' to the KeysToSanitize configuration to improve redaction, and requiring authorization on actuator endpoints to restrict access.