CVE-2026-50200: Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

Synopsis

This is an information-disclosure vulnerability in Steeltoe's Environment actuator, affecting Steeltoe.Management.Endpoint before 4.2.0 and Steeltoe.Management.EndpointCore before 3.4.0. The actuator's sanitizer component strips secrets by matching configuration key names against a suffix list, but the list does not cover the standard .NET ConnectionStrings pattern or Steeltoe Connectors' connection string keys, so full connection string values, including embedded passwords and user credentials, are returned verbatim in unauthenticated HTTP responses to the /actuator/env endpoint. Any network-reachable attacker with no credentials can read database passwords and other secrets embedded in connection strings. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the application's actuator HTTP endpoint over the network; no local access is needed.

• AuthenticationNot required

  No credentials are required; the /actuator/env endpoint returns sensitive values to any unauthenticated HTTP request.

• Victim interactionNot required

  Exploitation is fully passive and requires no action from any user or operator of the target application.

• Attack complexityDetail

  The exploit is a straightforward HTTP GET request with no race conditions or special environmental prerequisites; it is reliable and condition-free.

Blast Radius

• An attacker reads full database connection strings, including embedded passwords in Password= and user:pass@host formats, from the /actuator/env HTTP response.
• Any service credential stored as a .NET ConnectionStrings entry or a Steeltoe Connectors connection string key is exposed verbatim, potentially covering multiple downstream databases or message brokers.
• Leaked credentials can be reused directly against the referenced database or service hosts, enabling unauthorized data access beyond the application itself.