Configuration Exposure in Steeltoe Management Endpoint by Steeltoe

CVE-2026-50200

What is CVE-2026-50200?

In the Steeltoe.Management.Endpoint and Steeltoe.Management.EndpointCore libraries, a vulnerability allows sensitive configuration values, such as connection strings, to be exposed. The existing Sanitizer component fails to redact configuration key names that don't align with its default suffix list, resulting in sensitive information being returned in /actuator/env responses without any value-based scrubbing. This oversight puts applications at risk of exposing critical data, including database credentials. Users are urged to upgrade to the patched versions or implement defensive measures by updating the sanitation key lists and securing actuator endpoints accordingly.

References