CVE-2026-75523

Summary

Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI (inline user:password@host credentials) and does not inspect the query string. With IncludeQueryString enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the uri field of the response and written to logs at DEBUG level.

Impact

Any caller who can reach /actuator/httpexchanges can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the Steeltoe.Management.Endpoint.Actuators.HttpExchanges namespace also write these URIs to their application logs.

Affected configuration

• httpexchanges is explicitly added to the actuator exposure list (Management:Endpoints:Web:Exposure:Include). It is not included by default.
• The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links.
• DEBUG logging is enabled for Steeltoe.Management.Endpoint.Actuators.HttpExchanges (log exposure only).

Mitigations

If an immediate upgrade is not possible:

• Remove httpexchanges from the actuator exposure list, or restrict it behind authentication.
• Set Management:Endpoints:HttpExchanges:IncludeQueryString to false to strip query strings from recorded exchanges entirely.