What is the CVSS score of CVE-2026-50200?

CVE-2026-50200 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Steeltoe Management are affected by CVE-2026-50200?

Steeltoe.Management.Endpoint (versions before 4.2.0) and EndpointCore (versions before 3.4.0) transmit plaintext database connection strings, embedded passwords, and authentication credentials via…. A patch is available.

How to fix or mitigate CVE-2026-50200?

24 hours: Audit systems running Steeltoe.Management.Endpoint <4.2.0 or EndpointCore <3.4.0; restrict network access to `/actuator/env` endpoint using firewall, WAF, or network controls; immediately rotate all database connection credentials and embedded authentication secrets. 7 days: Enable logging and alerting for `/actuator/env` endpoint access; disable Steeltoe management endpoint if not operationally required; review logs for unauthorized credential exposure. 30 days: Monitor Steeltoe vendor releases for patches to Management.Endpoint and EndpointCore; plan and execute upgrades to patched versions; confirm all exposed credentials have been rotated.

Steeltoe Management CVE-2026-50200

EUVD-2026-37811 HIGH

Information Exposure (CWE-200)

2026-06-17 GitHub_M

GHSA-q62h-354g-5r85

Information Disclosure Steeltoe Management Endpoint Steeltoe Management Endpointcore Steeltoeoss

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network-reachable unauthenticated read of /actuator/env yields high confidentiality loss, but AC:H reflects the required non-default exposure of the env actuator and use of unmatched key names.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 02, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Jun 17, 2026 - 22:18 vuln.today

Analysis Generated

Jun 17, 2026 - 22:18 vuln.today

DescriptionCVE.org

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, the Sanitizer component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (password, secret, key, token, .*credentials.*, vcap_services) does not cover the standard .NET pattern ConnectionStrings:<name> or Steeltoe Connectors' Steeltoe:Client:<type>:Default:ConnectionString. There is no value-based scrubbing, so full connection string values including embedded Password= and user:pass@host segments are returned verbatim in /actuator/env responses. Steeltoe.Management.Endpoint 4.2.0 and Steeltoe.Management.EndpointCore 3.4.0 patch the issue. If an immediate upgrade is not possible: On the standard path, remove env from the actuator exposure list; add .*connectionstring.* to KeysToSanitize as a defense-in-depth measure for both paths; and/or require authorization on actuator endpoints.

AnalysisAI

Sensitive credential disclosure in Steeltoe.Management.Endpoint before 4.2.0 and Steeltoe.Management.EndpointCore before 3.4.0 allows remote attackers to retrieve plaintext database connection strings, embedded passwords, and URI userinfo segments via the /actuator/env endpoint. The Sanitizer's default key-suffix list omits the standard .NET ConnectionStrings:<name> pattern and the Steeltoe Connectors' Steeltoe:Client:<type>:Default:ConnectionString pattern, and performs no value-based scrubbing. No public exploit identified at time of analysis, but the fix and test cases are committed in public GitHub history, making the vulnerable behavior easy to reproduce.

Technical ContextAI

Steeltoe is a .NET cloud-native library suite that ports Spring Boot Actuator-style management endpoints to ASP.NET applications. The Environment actuator (/actuator/env) dumps the merged IConfiguration tree, which in .NET commonly includes ConnectionStrings:* entries populated from appsettings.json, environment variables, and cloud bindings. The Sanitizer class redacted values only when the configuration key matched one of six regex patterns (password, secret, key, token, .*credentials.*, vcap_services), none of which match ConnectionStrings:OrderDb or Steeltoe:Client:...:ConnectionString. This is a classic CWE-200 (Information Exposure) caused by an incomplete denylist: the sanitizer trusted key naming conventions and never inspected values for embedded Password=, Pwd=, or user:pass@host URI userinfo segments, so full ADO.NET, JDBC-style, and AMQP connection strings were returned verbatim.

RemediationAI

Vendor-released patch: upgrade Steeltoe.Management.Endpoint to 4.2.0 or Steeltoe.Management.EndpointCore to 3.4.0, which add .*connectionstring.* to the default sanitization list and introduce value-based scrubbing of embedded Password=/Pwd= pairs and URI userinfo (commits bef9f14b and e50cd31a). If upgrade is not immediately possible, remove env from the actuator exposure list on the standard path (which disables environment introspection for legitimate operators as a side effect), add .*connectionstring.* to the KeysToSanitize configuration option as a defense-in-depth measure on both paths (note this still does not scrub embedded secrets in arbitrarily named keys), and require authorization on all actuator endpoints via ASP.NET authorization policies. Full advisory and patch details: https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-q62h-354g-5r85.