Steeltoe Management CVE-2026-50200

Requires that the Steeltoe env actuator endpoint is included in the actuator exposure list AND is reachable by the attacker AND is not protected by an ASP.NET authorization policy. Exploitation further requires that the target application stores credentials under keys not matched by the default sanitizer denylist - specifically the standard .NET ConnectionStrings:<name> keys or the Steeltoe Connectors Steeltoe:Client:<type>:Default:ConnectionString keys, or any configuration value containing embedded Password=, Pwd=, or scheme://user:pass@host segments under a non-matching key name. Limiting factors: deployments that already require authorization on actuator endpoints, that have removed env from exposure, or that only use keys matching the legacy denylist (password, secret, key, token, credentials, vcap_services) are not exploitable.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) is plausible only when the env actuator is exposed without authentication - a known-bad but unfortunately common deployment pattern that mirrors the Spring Boot Actuator exposure issues seen historically. EPSS and KEV data were not provided; assuming no KEV listing and no published EPSS, this should be treated as a credible information-disclosure exposure rather than a confirmed mass-exploited issue. The real-world risk is highly bimodal: organizations that expose actuators publicly (or to a wide internal trust zone) face immediate credential theft enabling lateral movement into databases and message brokers, while deployments that require authorization on actuators or that omit env from the exposure list face essentially no risk. The PR:N rating is appropriate only under default actuator exposure assumptions - verify your deployment before assuming network-reachable exploitation.

An unauthenticated attacker discovers a publicly reachable Steeltoe-based .NET service and issues a single GET request to /actuator/env, receiving a JSON document containing the application's full ConnectionStrings:* values with embedded SQL Server, PostgreSQL, or RabbitMQ credentials. The attacker pivots by connecting directly to the disclosed database or message broker using the harvested credentials. No public exploit identified at time of analysis, but the fix commit's test vectors (e.g., Server=...;Password=myPassword;) provide a clear template for reproduction.