CVE-2026-50200: Steeltoe Management Endpoint Leaks Connection Strings and Database Credentials

Technical summary

The Environment actuator in Steeltoe.Management.Endpoint (pre-4.2.0) and Steeltoe.Management.EndpointCore (pre-3.4.0) uses a suffix-based key matcher to redact sensitive configuration at the `/actuator/env` endpoint. The default redaction list includes common patterns like `password`, `secret`, `key`, `token`, and regex-matched `credentials`, but does not account for `ConnectionStrings:<name>` (standard .NET Entity Framework pattern) or `Steeltoe:Client:<type>:Default:ConnectionString` (Steeltoe-specific connector pattern). The sanitizer performs no value-based content inspection, so connection strings embedded in configuration are returned unredacted in plaintext responses, exposing embedded credentials in formats such as `Password=value` or `user:pass@host`.

Business impact

Applications using Steeltoe management endpoints expose database credentials and service connection details to unauthenticated network-adjacent attackers, enabling direct database compromise, lateral movement to backend services, and potential data exfiltration. Organizations running multi-tenant cloud environments face heightened risk of cross-tenant reconnaissance. Regulatory frameworks (HIPAA, PCI-DSS, SOX) treating exposed credentials as a reportable breach event increase incident response costs and notification obligations. The severity is amplified in containerized or orchestrated deployments where the actuator endpoint may be accessible within internal networks without explicit segmentation.

Affected systems

Steeltoe.Management.Endpoint versions prior to 4.2.0 and Steeltoe.Management.EndpointCore versions prior to 3.4.0 are vulnerable. Any application using these packages with the Environment actuator enabled and exposed (via default actuator exposure settings) is at risk. This includes ASP.NET Core applications leveraging Steeltoe for cloud platform integration (Pivotal Cloud Foundry, Kubernetes, Azure, AWS).

Exploitability

Exploitation requires no authentication, no user interaction, and only network access to the `/actuator/env` endpoint (typically port 8080 or 8888 in development, or behind a load balancer in production). An attacker can enumerate the endpoint via port scanning or service discovery and retrieve credentials in a single HTTP GET request. The barrier to exploitation is therefore very low; the primary protection is network segmentation or endpoint access control.

Remediation

Upgrade to Steeltoe.Management.Endpoint 4.2.0 or later, and Steeltoe.Management.EndpointCore 3.4.0 or later. For applications unable to upgrade immediately, implement mitigations in priority order: (1) disable the `env` actuator in the exposure list; (2) add `.*connectionstring.*` as a custom regex pattern to the `KeysToSanitize` configuration (applies to both standard and Steeltoe connector patterns); (3) require authentication and authorization on all actuator endpoints using Spring Security or equivalent middleware; (4) restrict network access to the actuator port to trusted internal networks only.

Patch guidance

Check your csproj or package manifest for Steeltoe.Management.Endpoint and Steeltoe.Management.EndpointCore dependencies. Update both packages to 4.2.0 and 3.4.0 respectively (verify against official Steeltoe release notes and NuGet.org). Rebuild and redeploy. If you maintain a private NuGet feed, validate that packages are available in your internal repository before updating. After deployment, verify the `/actuator/env` endpoint no longer returns raw connection strings; test with a non-privileged application identity to confirm authorization enforcement is working.

Detection guidance

In existing deployments, query `/actuator/env` (requires network access to the management endpoint) and search response bodies for patterns like `ConnectionString`, `Password=`, or database connection formats (e.g., `Server=`, `Host=`, `user:pass@`). Log access to `/actuator/env` and alert on repeated requests or requests from external networks. Enable audit logging on database systems to detect unauthorized connection attempts using exposed credentials. Use static analysis tools (e.g., SonarQube, Snyk) to identify Steeltoe package versions in your codebase; flag any version below 4.2.0 or 3.4.0 as a remediation candidate.

Why prioritize this

CVSS 7.5 (HIGH) reflects high confidentiality impact with no authentication or interaction required. However, practical priority depends on (1) network exposure of the actuator endpoint, (2) sensitivity of databases accessed by the application, and (3) presence of multi-tenant or shared infrastructure. Prioritize patching for externally exposed applications, production databases with sensitive data (PII, financial records), and shared cloud platforms.

Risk score, explained

The vulnerability scores 7.5 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Network-accessible (`AV:N`), low complexity (`AC:L`), no privileges required (`PR:N`), no user interaction (`UI:N`), and single scope (`S:U`) combine for a base score of 7.5. High confidentiality impact (`C:H`) reflects exposure of authentication credentials; no integrity or availability impact because the endpoint is read-only. The score does not penalize for network segmentation or existing access controls, so organizations with properly restricted management ports may face lower practical risk.

Frequently asked questions