Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Check if your repositories are affected!View on GitHub

GHSA-8phw-xrj9-cpqp

MediumCVSS 5.9 / 10

Published Sep 17, 2026·Last modified Sep 17, 2026

Affected Components(1)

Steeltoe.Management.Endpoint

< 4.3.0

Description

Summary

Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI (inline user:password@host credentials) and does not inspect the query string. With IncludeQueryString enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the uri field of the response and written to logs at DEBUG level.

Impact

Any caller who can reach /actuator/httpexchanges can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the Steeltoe.Management.Endpoint.Actuators.HttpExchanges namespace also write these URIs to their application logs.

Affected configuration

httpexchanges is explicitly added to the actuator exposure list (Management:Endpoints:Web:Exposure:Include). It is not included by default.
The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links.
DEBUG logging is enabled for Steeltoe.Management.Endpoint.Actuators.HttpExchanges (log exposure only).

Mitigations

If an immediate upgrade is not possible:

Remove httpexchanges from the actuator exposure list, or restrict it behind authentication.
Set Management:Endpoints:HttpExchanges:IncludeQueryString to false to strip query strings from recorded exchanges entirely.

Upload your SBOM

Upload your own SBOM in CycloneDX 1.6 or higher (JSON) directly here to check your vulnerabilities.

Drag and drop some file here, or click to select

Risk Scores

Base Score

5.9

The vulnerability can be exploited over the network without needing physical access. It is difficult for an attacker to exploit this vulnerability and may require special conditions. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information.

Threat Intelligence

5.4

Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.

EPSS

0.44%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit

Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Related Vulnerabilities

Browse More

Medium severity

Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.