Executive brief
Steeltoe, a framework for building cloud-native .NET applications, contains a security flaw in its diagnostic tools. A component designed to hide sensitive information fails to recognize and redact database connection strings, which often contain plaintext usernames and passwords. If these diagnostic endpoints are exposed, an attacker could obtain these credentials to gain direct, unauthorized access to the application's backend databases.
Technical details
A sensitive information disclosure vulnerability exists in the Steeltoe Sanitizer component used by the Environment actuator. The root cause is an incomplete default suffix list for key-based redaction, which misses standard .NET patterns like 'ConnectionStrings:<name>' and 'Steeltoe:Client:<type>:Default:ConnectionString'. Additionally, the component lacked value-based scrubbing for URI-style credentials (e.g., user:pass@host). An attacker with network access to the /actuator/env or /cloudfoundryapplication/env endpoints can retrieve plaintext database credentials. The vulnerability is patched in Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 by adding '.*connectionstring.*' to the default sanitize list and implementing regex-based masking for 'Password=' and URI credentials.
Affected products
- SteeltoeOSS Steeltoe.Management.Endpoint <= 4.1.0
- SteeltoeOSS Steeltoe.Management.EndpointCore <= 3.3.0
Timeline
- 2026-05-29: disclosed
- 2026-06-17: advisory: NVD publication date
- 2026-07-02: patched: GitHub Advisory publication date
References
- https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-q62h-354g-5r85
- https://github.com/SteeltoeOSS/Steeltoe/commit/bef9f14b710232fca3fbe87e48fdd1b9e6b60d43
- https://github.com/SteeltoeOSS/Steeltoe/commit/e50cd31a429b191841120f0d38fa9dda8f751b0a
- https://api.github.com/repos/SteeltoeOSS/security-advisories/security-advisories/GHSA-q62h-354g-5r85