Threats affecting pkg:nuget/SteeltoeOSS/steeltoe.management.endpoint

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does not inspect query strings. When Management:Endpoints:HttpExchanges:IncludeQueryString is enabled, the HttpExchangeRequest response can disclose OAuth tokens, password-reset tokens, signed-URL signatures, API keys, and other query-string secrets from prior traffic to a caller that can reach the explicitly exposed endpoint. The Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logger also records these URIs, creating a second disclosure channel for users with log access. This issue is fixed in version 4.3.0.

CVE-2026-50201 is a privilege management vulnerability in Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0. Sensitive actuator endpoints such as heap dump, environment, and thread dump do not enforce the higher 'read_sensitive_data' permission, instead defaulting to a lower permission level. This could allow users with lower privileges to access sensitive data. The issue is patched in Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0. Mitigation includes upgrading to these versions or explicitly setting required permissions for sensitive endpoints or limiting actuator registration.

Steeltoe.Management.Endpoint versions prior to 4.2.0 and Steeltoe.Management.EndpointCore versions prior to 3.4.0 contain a vulnerability where sensitive configuration values, such as connection strings with embedded passwords, are not properly redacted in the /actuator/env endpoint responses. This occurs because the default sanitization list does not cover common connection string patterns, exposing sensitive information to unauthorized actors. Versions 4.2.0 and 3.4.0 include patches to address this issue. Mitigations include upgrading to fixed versions, removing the env endpoint from actuator exposure, adding connection string patterns to the sanitization keys, and requiring authorization on actuator endpoints.

Steeltoe.Management.Endpoint versions 3.2.2, 3.3.0, and 4.1.0 contain an authentication bypass vulnerability when configured to listen on an alternate port. The middleware incorrectly uses the HTTP Host header instead of the actual network socket port to restrict access, allowing potential unauthorized access to management endpoints. Versions 3.4.0 and 4.2.0 address this issue. Mitigations include upgrading to patched versions or applying explicit ASP.NET Core authorization and configuring reverse proxies to validate the Host header.