SteeltoeOSS Steeltoe.Management.Endpoint up to 4.1.x Configuration /actuator/env information disclosure

Summaryinfo

A vulnerability was found in SteeltoeOSS Steeltoe.Management.Endpoint and Steeltoe.Management.EndpointCore up to 4.1.x. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the file /actuator/env of the component Configuration Handler. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2026-50200. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in SteeltoeOSS Steeltoe.Management.Endpoint and Steeltoe.Management.EndpointCore up to 4.1.x. This affects an unknown function of the file /actuator/env of the component Configuration Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, the `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (`password`, `secret`, `key`, `token`, `.*credentials.*`, `vcap_services`) does not cover the standard .NET pattern `ConnectionStrings:` or Steeltoe Connectors' `Steeltoe:Client::Default:ConnectionString`. There is no value-based scrubbing, so full connection string values including embedded `Password=` and `user:pass@host` segments are returned verbatim in `/actuator/env` responses. Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 patch the issue. If an immediate upgrade is not possible: On the standard path, remove `env` from the actuator exposure list; add `.*connectionstring.*` to `KeysToSanitize` as a defense-in-depth measure for both paths; and/or require authorization on actuator endpoints.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-50200 since 06/04/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 4.2.0 eliminates this vulnerability. Applying the patch bef9f14b710232fca3fbe87e48fdd1b9e6b60d43 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• SteeltoeOSS

Name

• Steeltoe.Management.Endpoint
• Steeltoe.Management.EndpointCore

Version

• 4.0
• 4.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion