# CVE-2026-75523: Steeltoe Management.Endpoint HttpExchanges query-string secret exposure

Source: https://junglewise.ai/threats/cve-2026-75523-steeltoe-management-endpoint-httpexchanges-query-string-secret  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75523 · Severity: medium · CVSS 5.9 · Published 2026-09-17

Steeltoe's HTTP request logging endpoint (`/actuator/httpexchanges`) fails to mask secrets embedded in URL query strings, such as OAuth tokens, API keys, and password-reset links. Any user who can access this endpoint receives a history of raw request URIs containing these secrets, and the data is also written to application logs when DEBUG logging is enabled, potentially exposing sensitive credentials to unauthorized users.

Technologies: [Steeltoe.Management.Endpoint (NuGet)](https://junglewise.ai/threats/technologies/nuget-steeltoe-management-endpoint). Vendors: [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-75523 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75523 being exploited in the wild.

**How severe is CVE-2026-75523?** Medium severity, with a CVSS score of 5.9, published 17 September 2026.

**Which products and versions are affected?** Steeltoe.Management.Endpoint (NuGet) ECOSYSTEM:introduced=0,fixed=4.3.0; Steeltoe Management.Endpoint unspecified.

**Is there a fix for CVE-2026-75523?** Yes. Steeltoe.Management.Endpoint (NuGet): upgrade to 4.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75523 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75523?** Check whether you run Steeltoe.Management.Endpoint (NuGet) or Steeltoe Management.Endpoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Steeltoe.Management.Endpoint (NuGet): upgrade to 4.3.0 or later

  ```sh
  dotnet add package Steeltoe.Management.Endpoint --version 4.3.0
  ```


## Technical details

The `/actuator/httpexchanges` endpoint in Steeltoe records HTTP request metadata including the full request URI. The built-in URI masking mechanism only redacts the UserInfo portion (inline credentials like `user:password@host`) but does not mask secrets in query strings. When `IncludeQueryString` is enabled by default, OAuth tokens, API keys, signed-URL signatures, password-reset tokens, and other query-string-borne secrets are recorded and returned verbatim in the `uri` field. These URIs are also logged at DEBUG level. An attacker with network access to the endpoint (if not explicitly secured) or with DEBUG log file access can extract previously-seen query string secrets from live traffic.

## Affected products

- Steeltoe Management.Endpoint unspecified

## Identifiers

- CVE-2026-75523
- GHSA-8phw-xrj9-cpqp

## Timeline

- 2026-09-17: disclosed: GHSA-8phw-xrj9-cpqp published
- 2026: other: CVE-2026-75523 assigned

## Related threats

- [Steeltoe Improper Authorization in Management Actuator Endpoints](https://junglewise.ai/threats/cve-2026-50201-steeltoe-improper-authorization-in-management-actuator-endpoints)
- [Steeltoe Management Endpoint information disclosure in Environment actuator](https://junglewise.ai/threats/cve-2026-50200-steeltoe-management-endpoint-information-disclosure-in)
- [Steeltoe management port isolation bypass via spoofed Host header](https://junglewise.ai/threats/cve-2026-50194-steeltoe-management-port-isolation-bypass-via-spoofed-host-header)