CVE-2026-75523

## Summary Steeltoe's `/actuator/httpexchanges` endpoint records and displays request URIs after passing them through `MaskedUri`. The masking only covers the `UserInfo` portion of the URI (inline `user:password@host` credentials) and does not inspect the query string. With `IncludeQueryString` enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the `uri` field of the response and written to logs at DEBUG level. ## Impact Any caller who can reach `/actuator/httpexchanges` can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` namespace also write these URIs to their application logs. ## Affected configuration - `httpexchanges` is explicitly added to the actuator exposure list (`Management:Endpoints:Web:Exposure:Include`). It is not included by default. - The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links. - DEBUG logging is enabled for `Steeltoe.Management.Endpoint.Actuators.HttpExchanges` (log exposure only). ## Mitigations If an immediate upgrade is not possible: - Remove `httpexchanges` from the actuator exposure list, or restrict it behind authentication. - Set `Management:Endpoints:HttpExchanges:IncludeQueryString` to `false` to strip query strings from recorded exchanges entirely.