# CVE-2026-50200: Steeltoe Management Endpoint information disclosure in Environment actuator

Source: https://junglewise.ai/threats/cve-2026-50200-steeltoe-management-endpoint-information-disclosure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-50200 · Severity: high · CVSS 7.5 · Published 2026-06-17

Steeltoe, a framework for building cloud-native .NET applications, contains a security flaw in its diagnostic tools. A component designed to hide sensitive information fails to recognize and redact database connection strings, which often contain plaintext usernames and passwords. If these diagnostic endpoints are exposed, an attacker could obtain these credentials to gain direct, unauthorized access to the application's backend databases.

Technologies: [Steeltoe.Management.Endpoint (NuGet)](https://junglewise.ai/threats/technologies/nuget-steeltoe-management-endpoint), [SteeltoeOSS Steeltoe.Management.Endpoint](https://junglewise.ai/threats/technologies/steeltoe-management-endpoint), [SteeltoeOSS Steeltoe.Management.EndpointCore](https://junglewise.ai/threats/technologies/steeltoe-management-endpointcore). Vendors: [NuGet](https://junglewise.ai/threats/vendors/nuget), [SteeltoeOSS](https://junglewise.ai/threats/vendors/steeltoeoss).

## Quick answers

**Is CVE-2026-50200 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50200 being exploited in the wild.

**How severe is CVE-2026-50200?** High severity, with a CVSS score of 7.5, published 17 June 2026.

**Which products and versions are affected?** Steeltoe.Management.Endpoint (NuGet) ECOSYSTEM:introduced=0,fixed=4.2.0; Steeltoe.Management.EndpointCore (NuGet) ECOSYSTEM:introduced=0,fixed=3.4.0; SteeltoeOSS Steeltoe.Management.Endpoint < 4.2.0, <= 4.1.0; SteeltoeOSS Steeltoe.Management.EndpointCore < 3.4.0, <= 3.3.0.

**Is there a fix for CVE-2026-50200?** Yes. Steeltoe.Management.Endpoint (NuGet): upgrade to 4.2.0 or later; Steeltoe.Management.EndpointCore (NuGet): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50200 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50200?** Check whether you run Steeltoe.Management.Endpoint (NuGet), Steeltoe.Management.EndpointCore (NuGet), SteeltoeOSS Steeltoe.Management.Endpoint or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Steeltoe.Management.Endpoint (NuGet): upgrade to 4.2.0 or later

  ```sh
  dotnet add package Steeltoe.Management.Endpoint --version 4.2.0
  ```

- Steeltoe.Management.EndpointCore (NuGet): upgrade to 3.4.0 or later

  ```sh
  dotnet add package Steeltoe.Management.EndpointCore --version 3.4.0
  ```


## Technical details

A sensitive information disclosure vulnerability exists in the Steeltoe Sanitizer component used by the Environment actuator. The root cause is an incomplete default suffix list for key-based redaction, which misses standard .NET patterns like 'ConnectionStrings:<name>' and 'Steeltoe:Client:<type>:Default:ConnectionString'. Additionally, the component lacked value-based scrubbing for URI-style credentials (e.g., user:pass@host). An attacker with network access to the /actuator/env or /cloudfoundryapplication/env endpoints can retrieve plaintext database credentials. The vulnerability is patched in Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 by adding '.*connectionstring.*' to the default sanitize list and implementing regex-based masking for 'Password=' and URI credentials.

## Affected products

- SteeltoeOSS Steeltoe.Management.Endpoint <= 4.1.0
- SteeltoeOSS Steeltoe.Management.EndpointCore <= 3.3.0

## Identifiers

- CVE-2026-50200
- GHSA-q62h-354g-5r85

## Timeline

- 2026-05-29: disclosed
- 2026-06-17: advisory: NVD publication date
- 2026-07-02: patched: GitHub Advisory publication date

## References

- [https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-q62h-354g-5r85](https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-q62h-354g-5r85)
- [https://github.com/SteeltoeOSS/Steeltoe/commit/bef9f14b710232fca3fbe87e48fdd1b9e6b60d43](https://github.com/SteeltoeOSS/Steeltoe/commit/bef9f14b710232fca3fbe87e48fdd1b9e6b60d43)
- [https://github.com/SteeltoeOSS/Steeltoe/commit/e50cd31a429b191841120f0d38fa9dda8f751b0a](https://github.com/SteeltoeOSS/Steeltoe/commit/e50cd31a429b191841120f0d38fa9dda8f751b0a)
- [https://api.github.com/repos/SteeltoeOSS/security-advisories/security-advisories/GHSA-q62h-354g-5r85](https://api.github.com/repos/SteeltoeOSS/security-advisories/security-advisories/GHSA-q62h-354g-5r85)

## Related threats

- [Steeltoe Management.Endpoint HttpExchanges query-string secret exposure](https://junglewise.ai/threats/cve-2026-75523-steeltoe-management-endpoint-httpexchanges-query-string-secret)
- [Steeltoe Improper Authorization in Management Actuator Endpoints](https://junglewise.ai/threats/cve-2026-50201-steeltoe-improper-authorization-in-management-actuator-endpoints)
- [Steeltoe management port isolation bypass via spoofed Host header](https://junglewise.ai/threats/cve-2026-50194-steeltoe-management-port-isolation-bypass-via-spoofed-host-header)