CVE-2026-75523: Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets
Summary
Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI (inline user:password@host credentials) and does not inspect the query string. With IncludeQueryString enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the uri field of the response and written to logs at DEBUG level.
Impact
Any caller who can reach /actuator/httpexchanges can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the Steeltoe.Management.Endpoint.Actuators.HttpExchanges namespace also write these URIs to their application logs.
Affected configuration
- httpexchanges is explicitly added to the actuator exposure list (Management:Endpoints:Web:Exposure:Include). It is not included by default. - The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links. - DEBUG logging is enabled for Steeltoe.Management.Endpoint.Actuators.HttpExchanges (log exposure only).
Mitigations
If an immediate upgrade is not possible:
- Remove httpexchanges from the actuator exposure list, or restrict it behind authentication. - Set Management:Endpoints:HttpExchanges:IncludeQueryString to false to strip query strings from recorded exchanges entirely.
Other sources
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does not inspect query strings. When Management:Endpoints:HttpExchanges:IncludeQueryString is enabled, the HttpExchangeRequest response can disclose OAuth tokens, password-reset tokens, signed-URL signatures, API keys, and other query-string secrets from prior traffic to a caller that can reach the explicitly exposed endpoint. The Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logger also records these URIs, creating a second disclosure channel for users with log access. This issue is fixed in version 4.3.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/Steeltoe.Management.Endpointto a version that resolves this vulnerability.Fixed in 4.3.0 - Upgrade
Upgrade
Steeltoe.Management.Endpointto a version that resolves this vulnerability.Fixed in 4.3.0 - Configuration
Remove `httpexchanges` from the actuator exposure list (`Management:Endpoints:Web:Exposure:Include`) or restrict access behind authentication.
Steeltoe.Management.Endpoint (actuator) /actuator/httpexchanges Management:Endpoints:Web:Exposure:Include = Remove `httpexchanges` - Configuration
Set `Management:Endpoints:HttpExchanges:IncludeQueryString` to `false` to strip query strings from recorded exchanges entirely.
Steeltoe.Management.Endpoint (HttpExchanges) Management:Endpoints:HttpExchanges:IncludeQueryString = false
Event History
Frequently Asked Questions
Which deployments are exposed to this disclosure?
Deployments using Steeltoe.Management.Endpoint before 4.3.0 are exposed when Management:Endpoints:HttpExchanges:IncludeQueryString is enabled and the /actuator/httpexchanges endpoint is explicitly exposed to a caller. Users with access to the Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logs may also receive disclosed query-string secrets.
What access does an attacker need?
An attacker does not need prior privileges, but must be able to reach the explicitly exposed /actuator/httpexchanges endpoint. Exploitation depends on prior application traffic containing sensitive values in query strings, such as OAuth tokens, password-reset tokens, signed-URL signatures, or API keys.
Is the default configuration affected?
The endpoint disclosure requires Management:Endpoints:HttpExchanges:IncludeQueryString to be enabled. The provided information does not establish whether that setting is enabled by default.
What can be done before upgrading?
Disable inclusion of query strings for HTTP exchanges and restrict or remove exposure of the /actuator/httpexchanges endpoint. Also avoid enabling the Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logger and limit access to any logs that may contain recorded request URIs.
How can I determine whether secrets may already have been exposed?
Review access to the explicitly exposed /actuator/httpexchanges endpoint and to DEBUG logs from Steeltoe.Management.Endpoint.Actuators.HttpExchanges. If query-string recording was enabled, assess prior requests for sensitive query parameters and treat values visible through those channels as potentially disclosed.