GHSA-8PHW-XRJ9-CPQP Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Summary Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI inline user:password@host credentials and does not inspect the query string. With IncludeQueryString enabled by...

Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Summary Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI inline user:password@host credentials and does not inspect the query string. With IncludeQueryString enabled by...

CVE-2026-75523

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...

CVE-2026-75523 Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...

CVE-2026-75523 Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...

CVE-2026-75523 Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...

EUVD-2026-81898

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...

CVE-2026-75523

Steeltoe prior to 4.3.0 has a disclosure vulnerability in the /actuator/httpexchanges endpoint. The MaskedUri component masks URI user information but does not inspect query strings. When the Management:Endpoints:HttpExchanges:IncludeQueryString setting is enabled, recorded request URIs can leak ...

PT-2026-94381

Name of the Vulnerable Software and Affected Versions Steeltoe versions prior to 4.3.0 Description The /actuator/httpexchanges endpoint processes recorded request URIs using MaskedUri, which only masks user information and ignores query strings. When the...

CVE-2026-75523: Exposure of Sensitive Information to an Unauthorized Actor

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...