https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 20:31:48 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-75523 <p>Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does not inspect query strings. When Management:Endpoints:HttpExchanges:IncludeQueryString is enabled, the HttpExchangeRequest response can disclose OAuth tokens, password-reset tokens, signed-URL signatures, API keys, and other query-string secrets from prior traffic to a caller that can reach the explicitly exposed endpoint. The Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logger also records these URIs, creating a second disclosure channel for users with log access. This issue is fixed in version 4.3.0.</p> <p>Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs through MaskedUri, which masks URI user information but does not inspect query strings. When Management:Endpoints:HttpExchanges:IncludeQueryString is enabled, the HttpExchangeRequest response can disclose OAuth tokens, password-reset tokens, signed-URL signatures, API keys, and other query-string secrets from prior traffic to a caller that can reach the explicitly exposed endpoint. The Steeltoe.Management.Endpoint.Actuators.HttpExchanges DEBUG logger also records these URIs, creating a second disclosure channel for users with log access. This issue is fixed in version 4.3.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-75523 https://db.gcve.eu/vuln/ghsa-8phw-xrj9-cpqp <p><strong>Affected:</strong> NuGet: Steeltoe.Management.Endpoint</p> <p>## Summary</p> <p>Steeltoe&#39;s `/actuator/httpexchanges` endpoint records and displays request URIs after passing them through `MaskedUri`. The masking only covers the `UserInfo` portion of the URI (inline `user:password@host` credentials) and does not inspect the query string. With `IncludeQueryString` enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the `uri` field of the response and written to logs at DEBUG level.</p> <p>## Impact</p> <p>Any caller who can reach `/actuator/httpexchanges` can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` namespace also write these URIs to their application logs.</p> <p>## Affected configuration</p> <p>- `httpexchanges` is explicitly added to the actuator exposure list (`Management:Endpoints:Web:Exposure:Include`). It is not included by default. - The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links. - DEBUG logging is enabled for `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` (log exposure only).</p> <p>## Mitigations</p> <p>If an immediate upgrade is not possible:</p> <p>- Remove `httpexchanges` from the actuator exposure list, or restrict it behind authentication. - Set `Management:Endpoints:HttpExchanges:Include…</p> <p><strong>Affected:</strong> NuGet: Steeltoe.Management.Endpoint</p> <p>## Summary</p> <p>Steeltoe&#39;s `/actuator/httpexchanges` endpoint records and displays request URIs after passing them through `MaskedUri`. The masking only covers the `UserInfo` portion of the URI (inline `user:password@host` credentials) and does not inspect the query string. With `IncludeQueryString` enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the `uri` field of the response and written to logs at DEBUG level.</p> <p>## Impact</p> <p>Any caller who can reach `/actuator/httpexchanges` can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` namespace also write these URIs to their application logs.</p> <p>## Affected configuration</p> <p>- `httpexchanges` is explicitly added to the actuator exposure list (`Management:Endpoints:Web:Exposure:Include`). It is not included by default. - The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links. - DEBUG logging is enabled for `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` (log exposure only).</p> <p>## Mitigations</p> <p>If an immediate upgrade is not possible:</p> <p>- Remove `httpexchanges` from the actuator exposure list, or restrict it behind authentication. - Set `Management:Endpoints:HttpExchanges:Include…</p> https://db.gcve.eu/vuln/ghsa-8phw-xrj9-cpqp