Executive brief
Steeltoe's HTTP request logging endpoint (`/actuator/httpexchanges`) fails to mask secrets embedded in URL query strings, such as OAuth tokens, API keys, and password-reset links. Any user who can access this endpoint receives a history of raw request URIs containing these secrets, and the data is also written to application logs when DEBUG logging is enabled, potentially exposing sensitive credentials to unauthorized users.
Technical details
The `/actuator/httpexchanges` endpoint in Steeltoe records HTTP request metadata including the full request URI. The built-in URI masking mechanism only redacts the UserInfo portion (inline credentials like `user:password@host`) but does not mask secrets in query strings. When `IncludeQueryString` is enabled by default, OAuth tokens, API keys, signed-URL signatures, password-reset tokens, and other query-string-borne secrets are recorded and returned verbatim in the `uri` field. These URIs are also logged at DEBUG level. An attacker with network access to the endpoint (if not explicitly secured) or with DEBUG log file access can extract previously-seen query string secrets from live traffic.
Affected products
- Steeltoe Management.Endpoint unspecified
Timeline
- 2026-09-17: disclosed: GHSA-8phw-xrj9-cpqp published
- 2026: other: CVE-2026-75523 assigned