【高危】Steeltoe.Management.Endpoint 安全更新（GHSA-q62h-354g-5r85）

安全情报快照 · 风险级别：高危 · CVSS：7.5 · CVE-2026-50200 · GHSA-q62h-354g-5r85

先看结论

Steeltoe.Management.Endpoint存在安全风险，<= 4.1.0 受影响，建议升级至 4.2.0。

影响范围

生态	组件	受影响版本	首个修复版本
nuget	`Steeltoe.Management.Endpoint`	<= 4.1.0	4.2.0
nuget	`Steeltoe.Management.EndpointCore`	<= 3.3.0	3.4.0

处置建议

优先将 Steeltoe.Management.Endpoint 升级至 4.2.0 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Summary

The Sanitizer component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (password, secret, key, token, .*credentials.*, vcap_services) does not cover the standard .NET pattern ConnectionStrings:<name> or Steeltoe Connectors' Steeltoe:Client:<type>:Default:ConnectionString. There is no value-based scrubbing, so full connection string values including embedded Password= and user:pass@host segments are returned verbatim in /actuator/env responses.

Impact

Any caller who can reach /actuator/env can receive connection strings containing plaintext credentials. Those credentials enable direct connection to the backing database, bypassing the application tier.

Affected configuration

Application configuration contains credentials in ConnectionStrings:* or *:ConnectionString keys.
On standard deployments: env is added to Management:Endpoints:Actuator:Exposure:Include. This is not the default.
On Cloud Foundry: the /cloudfoundryapplication/env path is accessible to any authenticated CF user with read_basic_data permissions (Space Auditor and above) regardless of the exposure configuration.

Mitigations

If an immediate upgrade is not possible:

On the standard path, remove env from the actuator exposure list.
Add .*connectionstring.* to KeysToSanitize as a defense-in-depth measure for both paths.
Require authorization on actuator endpoints.

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。