{"id":"CVE-2026-50200","aliases":["EUVD-2026-37811","GHSA-q62h-354g-5r85"],"status":"published","title":"Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords","description":"Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, the `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (`password`, `secret`, `key`, `token`, `.*credentials.*`, `vcap_services`) does not cover the standard .NET pattern `ConnectionStrings:\u003cname\u003e` or Steeltoe Connectors' `Steeltoe:Client:\u003ctype\u003e:Default:ConnectionString`. There is no value-based scrubbing, so full connection string values including embedded `Password=` and `user:pass@host` segments are returned verbatim in `/actuator/env` responses. Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 patch the issue. If an immediate upgrade is not possible: On the standard path, remove `env` from the actuator exposure list; add `.*connectionstring.*` to `KeysToSanitize` as a defense-in-depth measure for both paths; and/or require authorization on actuator endpoints.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00185,"percentile":0.08175,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-319"],"published":"2026-06-17T21:44:21Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"NuGet","package":"Steeltoe.Management.Endpoint","fixed_in":["4.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Steeltoe.Management.EndpointCore","fixed_in":["3.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Steeltoe.Management.Endpoint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.0"},{"fixed":"4.2.0"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Steeltoe.Management.EndpointCore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.3.0"},{"fixed":"3.4.0"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Steeltoe.Management.Endpoint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}],"versions":["1.1.0","1.1.0-rc3","4.0.0","4.0.0-beta1","4.0.0-rc1","4.1.0"]},{"source":"osv","ecosystem":"NuGet","package":"Steeltoe.Management.EndpointCore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0"}]}],"versions":["2.0.0","2.0.0-rc1","2.0.1","2.1.0","2.1.0-rc1","2.1.1","2.2.0","2.2.0-rc1","2.2.0-rc2","2.2.1","2.3.0","2.3.0-rc1","2.3.0-rc2","2.4.0","2.4.0-rc1","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","3.0.0","3.0.0-m1","3.0.0-m2","3.0.0-m3","3.0.0-rc1","3.0.1","3.0.2","3.1.0","3.1.0-rc1","3.1.0-rc2","3.1.1","3.1.2","3.1.3","3.2.0","3.2.0-rc1","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.3.0"]}],"products":[{"vendor":"steeltoeoss","product":"steeltoe.management.endpoint"},{"vendor":"steeltoeoss","product":"steeltoe.management.endpointcore"}],"references":[{"url":"https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-q62h-354g-5r85","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/SteeltoeOSS/Steeltoe/commit/bef9f14b710232fca3fbe87e48fdd1b9e6b60d43","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/SteeltoeOSS/Steeltoe/commit/e50cd31a429b191841120f0d38fa9dda8f751b0a","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50200","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q62h-354g-5r85"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50200.json","tags":["advisory"]},{"url":"https://github.com/SteeltoeOSS/Steeltoe","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-50200","title":"Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords","description":"Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, the `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (`password`, `secret`, `key`, `token`, `.*credentials.*`, `vcap_services`) does not cover the standard .NET pattern `ConnectionStrings:\u003cname\u003e` or Steeltoe Connectors' `Steeltoe:Client:\u003ctype\u003e:Default:ConnectionString`. There is no value-based scrubbing, so full connection string values including embedded `Password=` and `user:pass@host` segments are returned verbatim in `/actuator/env` responses. Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 patch the issue. If an immediate upgrade is not possible: On the standard path, remove `env` from the actuator exposure list; add `.*connectionstring.*` to `KeysToSanitize` as a defense-in-depth measure for both paths; and/or require authorization on actuator endpoints.","status":"published","published":"2026-06-17T21:44:21.586Z","modified":"2026-06-18T15:45:27.834Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200","CWE-319"],"updated_at":"2026-11-02T14:20:08.734143Z"}],"euvd":[{"id":"EUVD-2026-37811","description":"Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, the `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (`password`, `secret`, `key`, `token`, `.*credentials.*`, `vcap_services`) does not cover the standard .NET pattern `ConnectionStrings:\u003cname\u003e` or Steeltoe Connectors' `Steeltoe:Client:\u003ctype\u003e:Default:ConnectionString`. There is no value-based scrubbing, so full connection string values including embedded `Password=` and `user:pass@host` segments are returned verbatim in `/actuator/env` responses. Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 patch the issue. If an immediate upgrade is not possible: On the standard path, remove `env` from the actuator exposure list; add `.*connectionstring.*` to `KeysToSanitize` as a defense-in-depth measure for both paths; and/or require authorization on actuator endpoints.","status":"published","published":"2026-06-17T21:44:21Z","modified":"2026-06-18T15:45:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:36.672794Z"}],"ghsa":[{"id":"GHSA-q62h-354g-5r85","title":"Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords","description":"### Summary\n\nThe `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (`password`, `secret`, `key`, `token`, `.*credentials.*`, `vcap_services`) does not cover the standard .NET pattern `ConnectionStrings:\u003cname\u003e` or Steeltoe Connectors' `Steeltoe:Client:\u003ctype\u003e:Default:ConnectionString`. There is no value-based scrubbing, so full connection string values including embedded `Password=` and `user:pass@host` segments are returned verbatim in `/actuator/env` responses.\n\n### Impact\n\nAny caller who can reach `/actuator/env` can receive connection strings containing plaintext credentials. Those credentials enable direct connection to the backing database, bypassing the application tier.\n\n### Affected configuration\n\n- Application configuration contains credentials in `ConnectionStrings:*` or `*:ConnectionString` keys.\n- On standard deployments: `env` is added to `Management:Endpoints:Actuator:Exposure:Include`. This is not the default.\n- On Cloud Foundry: the `/cloudfoundryapplication/env` path is accessible to any authenticated CF user with `read_basic_data` permissions (Space Auditor and above) regardless of the exposure configuration.\n\n### Mitigations\n\nIf an immediate upgrade is not possible:\n\n- On the standard path, remove `env` from the actuator exposure list.\n- Add `.*connectionstring.*` to `KeysToSanitize` as a defense-in-depth measure for both paths.\n- Require authorization on actuator endpoints.","status":"published","published":"2026-07-02T20:31:11Z","modified":"2026-07-02T20:31:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-319"],"updated_at":"2026-11-02T14:40:38.48196Z"}],"nvd":[{"id":"CVE-2026-50200","description":"Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, the `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (`password`, `secret`, `key`, `token`, `.*credentials.*`, `vcap_services`) does not cover the standard .NET pattern `ConnectionStrings:\u003cname\u003e` or Steeltoe Connectors' `Steeltoe:Client:\u003ctype\u003e:Default:ConnectionString`. There is no value-based scrubbing, so full connection string values including embedded `Password=` and `user:pass@host` segments are returned verbatim in `/actuator/env` responses. Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 patch the issue. If an immediate upgrade is not possible: On the standard path, remove `env` from the actuator exposure list; add `.*connectionstring.*` to `KeysToSanitize` as a defense-in-depth measure for both paths; and/or require authorization on actuator endpoints.","status":"published","published":"2026-06-17T22:16:24.453Z","modified":"2026-06-22T18:20:40.35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-200","CWE-319"],"updated_at":"2026-11-02T14:12:24.544761Z"}],"osv":[{"id":"CVE-2026-50200","title":"Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords","description":"Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, the `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (`password`, `secret`, `key`, `token`, `.*credentials.*`, `vcap_services`) does not cover the standard .NET pattern `ConnectionStrings:\u003cname\u003e` or Steeltoe Connectors' `Steeltoe:Client:\u003ctype\u003e:Default:ConnectionString`. There is no value-based scrubbing, so full connection string values including embedded `Password=` and `user:pass@host` segments are returned verbatim in `/actuator/env` responses. Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 patch the issue. If an immediate upgrade is not possible: On the standard path, remove `env` from the actuator exposure list; add `.*connectionstring.*` to `KeysToSanitize` as a defense-in-depth measure for both paths; and/or require authorization on actuator endpoints.","status":"published","published":"2026-06-17T21:44:21.586Z","modified":"2026-10-28T02:31:00.017355822Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-319"],"updated_at":"2026-11-02T15:45:07.431113Z"},{"id":"GHSA-q62h-354g-5r85","title":"Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords","description":"### Summary\n\nThe `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (`password`, `secret`, `key`, `token`, `.*credentials.*`, `vcap_services`) does not cover the standard .NET pattern `ConnectionStrings:\u003cname\u003e` or Steeltoe Connectors' `Steeltoe:Client:\u003ctype\u003e:Default:ConnectionString`. There is no value-based scrubbing, so full connection string values including embedded `Password=` and `user:pass@host` segments are returned verbatim in `/actuator/env` responses.\n\n### Impact\n\nAny caller who can reach `/actuator/env` can receive connection strings containing plaintext credentials. Those credentials enable direct connection to the backing database, bypassing the application tier.\n\n### Affected configuration\n\n- Application configuration contains credentials in `ConnectionStrings:*` or `*:ConnectionString` keys.\n- On standard deployments: `env` is added to `Management:Endpoints:Actuator:Exposure:Include`. This is not the default.\n- On Cloud Foundry: the `/cloudfoundryapplication/env` path is accessible to any authenticated CF user with `read_basic_data` permissions (Space Auditor and above) regardless of the exposure configuration.\n\n### Mitigations\n\nIf an immediate upgrade is not possible:\n\n- On the standard path, remove `env` from the actuator exposure list.\n- Add `.*connectionstring.*` to `KeysToSanitize` as a defense-in-depth measure for both paths.\n- Require authorization on actuator endpoints.","status":"published","published":"2026-07-02T20:31:11Z","modified":"2026-07-02T20:56:33.128504Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-319"],"updated_at":"2026-11-02T15:46:54.055966Z"}]}}