Is CVE-2026-75523 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75523 being exploited in the wild.

How severe is CVE-2026-75523?

Medium severity, with a CVSS score of 5.9, published 17 September 2026.

Which products and versions are affected?

Steeltoe.Management.Endpoint (NuGet) ECOSYSTEM:introduced=0,fixed=4.3.0; Steeltoe Management.Endpoint unspecified.

Is there a fix for CVE-2026-75523?

Yes. Steeltoe.Management.Endpoint (NuGet): upgrade to 4.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75523 attacked?

It is attacked over the network.

Am I affected by CVE-2026-75523?

Check whether you run Steeltoe.Management.Endpoint (NuGet) or Steeltoe Management.Endpoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75523: Steeltoe Management.Endpoint HttpExchanges query-string secret exposure

CVE-2026-75523 · Severity: medium · CVSS 5.9 · Published 2026-09-17

Steeltoe's HTTP request logging endpoint (`/actuator/httpexchanges`) fails to mask secrets embedded in URL query strings, such as OAuth tokens, API keys, and password-reset links. Any user who can access this endpoint receives a history of raw request URIs containing these secrets, and the data is also written to application logs when DEBUG logging is enabled, potentially exposing sensitive credentials to unauthorized users.

Technologies: Steeltoe.Management.Endpoint (NuGet). Vendors: NuGet.

Quick answers

Is CVE-2026-75523 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75523 being exploited in the wild.
How severe is CVE-2026-75523?: Medium severity, with a CVSS score of 5.9, published 17 September 2026.
Which products and versions are affected?: Steeltoe.Management.Endpoint (NuGet) ECOSYSTEM:introduced=0,fixed=4.3.0; Steeltoe Management.Endpoint unspecified.
Is there a fix for CVE-2026-75523?: Yes. Steeltoe.Management.Endpoint (NuGet): upgrade to 4.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75523 attacked?: It is attacked over the network.
Am I affected by CVE-2026-75523?: Check whether you run Steeltoe.Management.Endpoint (NuGet) or Steeltoe Management.Endpoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Steeltoe.Management.Endpoint (NuGet): upgrade to 4.3.0 or later

dotnet add package Steeltoe.Management.Endpoint --version 4.3.0

Technical details

The `/actuator/httpexchanges` endpoint in Steeltoe records HTTP request metadata including the full request URI. The built-in URI masking mechanism only redacts the UserInfo portion (inline credentials like `user:password@host`) but does not mask secrets in query strings. When `IncludeQueryString` is enabled by default, OAuth tokens, API keys, signed-URL signatures, password-reset tokens, and other query-string-borne secrets are recorded and returned verbatim in the `uri` field. These URIs are also logged at DEBUG level. An attacker with network access to the endpoint (if not explicitly secured) or with DEBUG log file access can extract previously-seen query string secrets from live traffic.

Affected products

Steeltoe Management.Endpoint unspecified

Identifiers

CVE-2026-75523
GHSA-8phw-xrj9-cpqp

Timeline

2026-09-17: disclosed: GHSA-8phw-xrj9-cpqp published
2026: other: CVE-2026-75523 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.