CVE-2026-75523

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...

CVE-2026-75523 Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does...

CVE-2026-75523

Steeltoe prior to 4.3.0 has a disclosure vulnerability in the /actuator/httpexchanges endpoint. The MaskedUri component masks URI user information but does not inspect query strings. When the Management:Endpoints:HttpExchanges:IncludeQueryString setting is enabled, recorded request URIs can leak ...