https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T16:59:57.130466+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-75523 fkie_cve-2026-75523 2026-09-30T16:59:57.137034+00:00

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does not inspect query strings. When Management:Endpoints:HttpExchanges:IncludeQueryString is enabled, the HttpExchangeRequest response can disclose OAuth tokens, password-reset tokens, signed-URL signatures, API keys, and other query-string secrets from prior traffic to a caller that can reach the explicitly exposed endpoint. The Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logger also records these URIs, creating a second disclosure channel for users with log access. This issue is fixed in version 4.3.0.

 https://vulnerability.circl.lu/vuln/ghsa-8phw-xrj9-cpqp GHSA-8phw-xrj9-cpqp — Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets 2026-09-30T16:59:57.137751+00:00

Affected: NuGet: Steeltoe.Management.Endpoint

## Summary

Steeltoe's `/actuator/httpexchanges` endpoint records and displays request URIs after passing them through `MaskedUri`. The masking only covers the `UserInfo` portion of the URI (inline `user:password@host` credentials) and does not inspect the query string. With `IncludeQueryString` enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the `uri` field of the response and written to logs at DEBUG level.

## Impact

Any caller who can reach `/actuator/httpexchanges` can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` namespace also write these URIs to their application logs.

## Affected configuration

- `httpexchanges` is explicitly added to the actuator exposure list (`Management:Endpoints:Web:Exposure:Include`). It is not included by default. - The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links. - DEBUG logging is enabled for `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` (log exposure only).

## Mitigations

If an immediate upgrade is not possible:

- Remove `httpexchanges` from the actuator exposure list, or restrict it behind authentication. - Set `Management:Endpoints:HttpExchanges:Include…