{"id":"GHSA-q62h-354g-5r85","summary":"Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords","details":"### Summary\n\nThe `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (`password`, `secret`, `key`, `token`, `.*credentials.*`, `vcap_services`) does not cover the standard .NET pattern `ConnectionStrings:\u003cname\u003e` or Steeltoe Connectors' `Steeltoe:Client:\u003ctype\u003e:Default:ConnectionString`. There is no value-based scrubbing, so full connection string values including embedded `Password=` and `user:pass@host` segments are returned verbatim in `/actuator/env` responses.\n\n### Impact\n\nAny caller who can reach `/actuator/env` can receive connection strings containing plaintext credentials. Those credentials enable direct connection to the backing database, bypassing the application tier.\n\n### Affected configuration\n\n- Application configuration contains credentials in `ConnectionStrings:*` or `*:ConnectionString` keys.\n- On standard deployments: `env` is added to `Management:Endpoints:Actuator:Exposure:Include`. This is not the default.\n- On Cloud Foundry: the `/cloudfoundryapplication/env` path is accessible to any authenticated CF user with `read_basic_data` permissions (Space Auditor and above) regardless of the exposure configuration.\n\n### Mitigations\n\nIf an immediate upgrade is not possible:\n\n- On the standard path, remove `env` from the actuator exposure list.\n- Add `.*connectionstring.*` to `KeysToSanitize` as a defense-in-depth measure for both paths.\n- Require authorization on actuator endpoints.","aliases":["CVE-2026-50200"],"modified":"2026-07-02T20:45:16.479764051Z","published":"2026-07-02T20:31:11Z","database_specific":{"github_reviewed_at":"2026-07-02T20:31:11Z","nvd_published_at":"2026-06-17T22:16:24Z","cwe_ids":["CWE-200","CWE-319"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-q62h-354g-5r85"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50200"},{"type":"WEB","url":"https://github.com/SteeltoeOSS/Steeltoe/commit/bef9f14b710232fca3fbe87e48fdd1b9e6b60d43"},{"type":"WEB","url":"https://github.com/SteeltoeOSS/Steeltoe/commit/e50cd31a429b191841120f0d38fa9dda8f751b0a"},{"type":"PACKAGE","url":"https://github.com/SteeltoeOSS/Steeltoe"}],"affected":[{"package":{"name":"Steeltoe.Management.Endpoint","ecosystem":"NuGet","purl":"pkg:nuget/Steeltoe.Management.Endpoint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}],"versions":["1.1.0","1.1.0-rc3","4.0.0","4.0.0-beta1","4.0.0-rc1","4.1.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 4.1.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-q62h-354g-5r85/GHSA-q62h-354g-5r85.json"}},{"package":{"name":"Steeltoe.Management.EndpointCore","ecosystem":"NuGet","purl":"pkg:nuget/Steeltoe.Management.EndpointCore"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0"}]}],"versions":["2.0.0","2.0.0-rc1","2.0.1","2.1.0","2.1.0-rc1","2.1.1","2.2.0","2.2.0-rc1","2.2.0-rc2","2.2.1","2.3.0","2.3.0-rc1","2.3.0-rc2","2.4.0","2.4.0-rc1","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","3.0.0","3.0.0-m1","3.0.0-m2","3.0.0-m3","3.0.0-rc1","3.0.1","3.0.2","3.1.0","3.1.0-rc1","3.1.0-rc2","3.1.1","3.1.2","3.1.3","3.2.0","3.2.0-rc1","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.3.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 3.3.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-q62h-354g-5r85/GHSA-q62h-354g-5r85.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}