CVE-2026-50200: Steeltoe Management Endpoint information disclosure in Environment actuator

CVE-2026-50200 · Severity: high · CVSS 7.5 · Published 2026-06-17

Steeltoe, a framework for building cloud-native .NET applications, contains a security flaw in its diagnostic tools. A component designed to hide sensitive information fails to recognize and redact database connection strings, which often contain plaintext usernames and passwords. If these diagnostic endpoints are exposed, an attacker could obtain these credentials to gain direct, unauthorized access to the application's backend databases.

Technologies: Steeltoe.Management.Endpoint (NuGet), SteeltoeOSS Steeltoe.Management.Endpoint, SteeltoeOSS Steeltoe.Management.EndpointCore. Vendors: NuGet, SteeltoeOSS.

Quick answers

Is CVE-2026-50200 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50200 being exploited in the wild.
How severe is CVE-2026-50200?
High severity, with a CVSS score of 7.5, published 17 June 2026.
Which products and versions are affected?
Steeltoe.Management.Endpoint (NuGet) ECOSYSTEM:introduced=0,fixed=4.2.0; Steeltoe.Management.EndpointCore (NuGet) ECOSYSTEM:introduced=0,fixed=3.4.0; SteeltoeOSS Steeltoe.Management.Endpoint < 4.2.0, <= 4.1.0; SteeltoeOSS Steeltoe.Management.EndpointCore < 3.4.0, <= 3.3.0.
Is there a fix for CVE-2026-50200?
Yes. Steeltoe.Management.Endpoint (NuGet): upgrade to 4.2.0 or later; Steeltoe.Management.EndpointCore (NuGet): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50200 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50200?
Check whether you run Steeltoe.Management.Endpoint (NuGet), Steeltoe.Management.EndpointCore (NuGet), SteeltoeOSS Steeltoe.Management.Endpoint or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Steeltoe.Management.Endpoint (NuGet): upgrade to 4.2.0 or later
    dotnet add package Steeltoe.Management.Endpoint --version 4.2.0
  • Steeltoe.Management.EndpointCore (NuGet): upgrade to 3.4.0 or later
    dotnet add package Steeltoe.Management.EndpointCore --version 3.4.0

Technical details

A sensitive information disclosure vulnerability exists in the Steeltoe Sanitizer component used by the Environment actuator. The root cause is an incomplete default suffix list for key-based redaction, which misses standard .NET patterns like 'ConnectionStrings:<name>' and 'Steeltoe:Client:<type>:Default:ConnectionString'. Additionally, the component lacked value-based scrubbing for URI-style credentials (e.g., user:pass@host). An attacker with network access to the /actuator/env or /cloudfoundryapplication/env endpoints can retrieve plaintext database credentials. The vulnerability is patched in Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 by adding '.*connectionstring.*' to the default sanitize list and implementing regex-based masking for 'Password=' and URI credentials.

Affected products

  • SteeltoeOSS Steeltoe.Management.Endpoint <= 4.1.0
  • SteeltoeOSS Steeltoe.Management.EndpointCore <= 3.3.0

Identifiers

  • CVE-2026-50200
  • GHSA-q62h-354g-5r85

Timeline

  • 2026-05-29: disclosed
  • 2026-06-17: advisory: NVD publication date
  • 2026-07-02: patched: GitHub Advisory publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.