EUVD-2026-81898
GHSA-8phw-xrj9-cpqp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable endpoint with no modeled auth (PR:N), but AC:H because it depends on a non-default flag and on secrets actually present in captured query strings; confidentiality-only, so I/A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does not inspect query strings. When Management:Endpoints:HttpExchanges:IncludeQueryString is enabled, the HttpExchangeRequest response can disclose OAuth tokens, password-reset tokens, signed-URL signatures, API keys, and other query-string secrets from prior traffic to a caller that can reach the explicitly exposed endpoint. The Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logger also records these URIs, creating a second disclosure channel for users with log access. This issue is fixed in version 4.3.0.
AnalysisAI
Information disclosure in Steeltoe's Management Endpoint actuator (Steeltoe.Management.Endpoint) prior to 4.3.0 allows an unauthenticated remote attacker who can reach the exposed /actuator/httpexchanges endpoint to harvest secrets that were previously captured in recorded request query strings - OAuth and password-reset tokens, API keys, and signed-URL signatures - because MaskedUri only redacts URI user-info and never inspects the query string. The same recorded URIs are written by the Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logger, giving anyone with log access a second disclosure channel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires ALL of: (1) the non-default configuration Management:Endpoints:HttpExchanges:IncludeQueryString set to enabled; (2) the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint explicitly exposed and reachable by the attacker (or, for the secondary channel, the attacker having read access to the HttpExchanges DEBUG logs); and (3) prior recorded traffic whose request URIs actually carried secrets in query strings (OAuth tokens, password-reset tokens, signed-URL signatures, API keys). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, config-gated information-disclosure issue rather than a top-tier priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Steeltoe 4.3.0 (https://github.com/SteeltoeOSS/Steeltoe/releases/tag/4.3.0), which introduces query-string masking in MaskedUri via commit 9bf0ecb9f2d4a34b65f61d41c5625d49071ae9fa; see advisory GHSA-8phw-xrj9-cpqp for vendor guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Changjetong T+ (through 16.x) has .NET deserialization RCE in an AjaxPro endpoint. Attacker-controlled JSON triggers des
SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.
SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL st
PowerDocu versions prior to 2.4.0 allow arbitrary .NET object instantiation and code execution through unsafe deserializ
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a net
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML
Asp.Net-Core-Inventory-Order-Management-System versions up to 9.20250118. contains a security vulnerability (CVSS 6.3).
Insecure .NET Remoting deserialization in Altec DocLink (Beyond Limits) 4.0.336.0. Exposed TCP endpoints allow unauthent
Microsoft Semantic Kernel SDK has a CVSS 9.9 path traversal vulnerability enabling AI agents to access arbitrary files o
Unauthenticated .NET Remoting endpoint in Calero VeraSMART before 2022 R1. TCP port 8001 exposes default Object URIs ena
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today