{"affected":[{"database_specific":{"last_known_affected_version_range":"<= 4.2.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8phw-xrj9-cpqp/GHSA-8phw-xrj9-cpqp.json"},"package":{"ecosystem":"NuGet","name":"Steeltoe.Management.Endpoint","purl":"pkg:nuget/Steeltoe.Management.Endpoint"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.3.0"}],"type":"ECOSYSTEM"}],"versions":["1.1.0","1.1.0-rc3","4.0.0","4.0.0-beta1","4.0.0-rc1","4.1.0","4.2.0"]}],"aliases":["CVE-2026-75523"],"database_specific":{"cwe_ids":["CWE-200"],"github_reviewed":true,"github_reviewed_at":"2026-09-17T18:01:30Z","nvd_published_at":null,"severity":"MODERATE"},"details":"## Summary\n\nSteeltoe's `/actuator/httpexchanges` endpoint records and displays request URIs after passing them through `MaskedUri`. The masking only covers the `UserInfo` portion of the URI (inline `user:password@host` credentials) and does not inspect the query string. With `IncludeQueryString` enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the `uri` field of the response and written to logs at DEBUG level.\n\n## Impact\n\nAny caller who can reach `/actuator/httpexchanges` can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` namespace also write these URIs to their application logs.\n\n## Affected configuration\n\n- `httpexchanges` is explicitly added to the actuator exposure list (`Management:Endpoints:Web:Exposure:Include`). It is not included by default.\n- The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links.\n- DEBUG logging is enabled for `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` (log exposure only).\n\n## Mitigations\n\nIf an immediate upgrade is not possible:\n\n- Remove `httpexchanges` from the actuator exposure list, or restrict it behind authentication.\n- Set `Management:Endpoints:HttpExchanges:IncludeQueryString` to `false` to strip query strings from recorded exchanges entirely.","id":"GHSA-8phw-xrj9-cpqp","modified":"2026-09-17T18:15:04.169267823Z","published":"2026-09-17T18:01:30Z","references":[{"type":"WEB","url":"https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-8phw-xrj9-cpqp"},{"type":"WEB","url":"https://github.com/SteeltoeOSS/Steeltoe/commit/9bf0ecb9f2d4a34b65f61d41c5625d49071ae9fa"},{"type":"WEB","url":"https://github.com/SteeltoeOSS/Steeltoe/releases/tag/4.3.0"},{"type":"PACKAGE","url":"https://github.com/SteeltoeOSS/security-advisories"}],"schema_version":"1.9.0","severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"}],"summary":"Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets"}