CVE-2026-50200

Name of the Vulnerable Software and Affected Versions Steeltoe.Management.Endpoint versions prior to 4.2.0 Steeltoe.Management.EndpointCore versions prior to 3.4.0

Description The Sanitizer component in the Environment actuator redacts configuration values by matching key names against a suffix list. However, the default list does not cover the standard .NET pattern ConnectionStrings:<name> or Steeltoe Connectors' Steeltoe:Client:<type>:Default:ConnectionString. Because there is no value-based scrubbing, full connection string values, including embedded Password= and user:pass@host segments, are returned verbatim in the '/actuator/env' endpoint responses.

Recommendations Update Steeltoe.Management.Endpoint to version 4.2.0. Update Steeltoe.Management.EndpointCore to version 3.4.0. Remove env from the actuator exposure list. Add .*connectionstring.* to KeysToSanitize as a defense-in-depth measure. Require authorization on actuator endpoints.