CVE-2026-50200: Steeltoe Information Disclosure Flaw

CVE-2026-50200 Overview

CVE-2026-50200 is an information disclosure vulnerability in Steeltoe, an open source library collection for building cloud-native .NET applications. The Sanitizer component in the Environment actuator fails to redact connection string values returned by the /actuator/env endpoint. The default KeysToSanitize list does not match the standard .NET ConnectionStrings:<name> pattern or the Steeltoe Connectors Steeltoe:Client:<type>:Default:ConnectionString pattern. As a result, full connection strings including embedded Password= parameters and user:pass@host segments are returned verbatim. The flaw is categorized as [CWE-200] Information Exposure.

Critical Impact
Unauthenticated network attackers can retrieve plaintext database credentials and other secrets from exposed Steeltoe /actuator/env endpoints.

Affected Products

Steeltoe.Management.Endpoint prior to version 4.2.0
Steeltoe.Management.EndpointCore prior to version 3.4.0
.NET applications using Steeltoe Connectors with exposed Environment actuator

Discovery Timeline

2026-06-17 - CVE-2026-50200 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50200

Vulnerability Analysis

The Steeltoe Environment actuator exposes application configuration through the /actuator/env HTTP endpoint. To prevent leaking secrets, the Sanitizer component matches configuration key names against a suffix list and replaces matched values with ******. The default list contains password, secret, key, token, .*credentials.*, and vcap_services.

This list does not match keys following the standard .NET configuration convention for database connections. Keys named ConnectionStrings:Default or Steeltoe:Client:SqlServer:Default:ConnectionString pass through unredacted. The sanitization logic operates only on key names with no value-based scrubbing, so embedded credentials inside connection string values remain visible.

An attacker who can reach the actuator endpoint can extract database hostnames, usernames, and passwords. Recovered credentials enable lateral movement to backend databases, message brokers, and cloud services referenced in the application configuration.

Root Cause

The root cause is an incomplete deny-list in the sanitizer's KEYS_TO_SANITIZE array combined with the absence of value-level pattern detection. The sanitizer never inspects the value itself for connection-string indicators such as Password=, Pwd=, or ://user:pass@.

Attack Vector

An unauthenticated attacker sends an HTTP GET request to /actuator/env on a Steeltoe-enabled application. If the env actuator is in the exposure list and authorization is not enforced, the response includes the full configuration tree with unredacted connection strings.

The patch adds .*connectionstring.* to the default sanitization list:

text

// Patch in EnvEndpointOptions.cs (Steeltoe.Management.EndpointCore 3.4.0)
- private static readonly string[] KEYS_TO_SANITIZE = new string[] { "password", "secret", "key", "token", ".*credentials.*", "vcap_services" };
+ private static readonly string[] KEYS_TO_SANITIZE = new string[] { "password", "secret", "key", "token", ".*credentials.*", "vcap_services", ".*connectionstring.*" };

Source: GitHub commit bef9f14

A parallel change in ConfigureEnvironmentEndpointOptions.cs applies the same fix for Steeltoe.Management.Endpoint 4.2.0. Source: GitHub commit e50cd31.

Detection Methods for CVE-2026-50200

Indicators of Compromise

HTTP GET requests to /actuator/env or /actuator/env/{name} from external or untrusted source IPs.
HTTP 200 responses from actuator endpoints containing strings such as ConnectionStrings: or Steeltoe:Client:.
Outbound database authentication attempts originating from unexpected source IPs shortly after actuator access.
Web server access logs showing repeated enumeration of /actuator/* paths.

Detection Strategies

Inventory all Steeltoe applications and identify which expose the env actuator by inspecting management:endpoints:actuator:exposure:include configuration.
Probe /actuator/env from a non-trusted network segment and inspect responses for unredacted values matching connection string patterns.
Deploy WAF or reverse proxy rules that match request paths containing /actuator/env and alert on access from non-administrative sources.
Run dependency scans against .csproj and packages.lock.json files for Steeltoe.Management.Endpoint below 4.2.0 or Steeltoe.Management.EndpointCore below 3.4.0.

Monitoring Recommendations

Forward application and reverse proxy logs to a central SIEM and alert on any external access to /actuator/* paths.
Monitor database authentication logs for logins from application service accounts originating from unexpected source addresses.
Track configuration drift in appsettings.json for unintended additions to the actuator exposure list.

How to Mitigate CVE-2026-50200

Immediate Actions Required

Upgrade Steeltoe.Management.Endpoint to version 4.2.0 or Steeltoe.Management.EndpointCore to version 3.4.0.
Remove env from the actuator exposure list on any application that cannot be upgraded immediately.
Require authentication and authorization on all actuator endpoints, restricting access to operators only.
Rotate any database passwords and connection secrets that may have been exposed through /actuator/env.

Patch Information

The vendor released fixes in Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0. Both releases add .*connectionstring.* to the default KeysToSanitize list. Refer to the GitHub Security Advisory GHSA-q62h-354g-5r85 for full release notes.

Workarounds

Add .*connectionstring.* to the KeysToSanitize configuration as a defense-in-depth measure on both the standard and Steeltoe Connectors paths.
Remove env from management:endpoints:actuator:exposure:include until upgrade is complete.
Place actuator endpoints behind authenticated routes and restrict network access to internal management networks only.

bash

# appsettings.json - defense-in-depth configuration
{
  "Management": {
    "Endpoints": {
      "Actuator": {
        "Exposure": {
          "Include": [ "health", "info" ]
        }
      },
      "Env": {
        "KeysToSanitize": [
          "password",
          "secret",
          "key",
          "token",
          ".*credentials.*",
          "vcap_services",
          ".*connectionstring.*"
        ]
      }
    }
  }
}