Steeltoe.Management.Endpoint

Summary

Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI (inline user:password@host credentials) and does not inspect the query string. With IncludeQueryString enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the uri field of the response and written to logs at DEBUG level.

Impact

Any caller who can reach /actuator/httpexchanges can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the Steeltoe.Management.Endpoint.Actuators.HttpExchanges namespace also write these URIs to their application logs.

Affected configuration

• httpexchanges is explicitly added to the actuator exposure list (Management:Endpoints:Web:Exposure:Include). It is not included by default.
• The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links.
• DEBUG logging is enabled for Steeltoe.Management.Endpoint.Actuators.HttpExchanges (log exposure only).

Mitigations

If an immediate upgrade is not possible:

• Remove httpexchanges from the actuator exposure list, or restrict it behind authentication.
• Set Management:Endpoints:HttpExchanges:IncludeQueryString to false to strip query strings from recorded exchanges entirely.

Summary

Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI (inline user:password@host credentials) and does not inspect the query string. With IncludeQueryString enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the uri field of the response and written to logs at DEBUG level.

Impact

Any caller who can reach /actuator/httpexchanges can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the Steeltoe.Management.Endpoint.Actuators.HttpExchanges namespace also write these URIs to their application logs.

Affected configuration

• httpexchanges is explicitly added to the actuator exposure list (Management:Endpoints:Web:Exposure:Include). It is not included by default.
• The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links.
• DEBUG logging is enabled for Steeltoe.Management.Endpoint.Actuators.HttpExchanges (log exposure only).

Mitigations

If an immediate upgrade is not possible:

• Remove httpexchanges from the actuator exposure list, or restrict it behind authentication.
• Set Management:Endpoints:HttpExchanges:IncludeQueryString to false to strip query strings from recorded exchanges entirely.

Summary

All Steeltoe actuator endpoints default to EndpointPermissions.Restricted, which is mapped to Cloud Foundry's read_basic_data permission (granted to Space Auditors and similar low-trust roles). Sensitive actuators including heap dump, environment, and thread dump do not raise this to EndpointPermissions.Full, so CF's read_sensitive_data permission flag is not enforced for those endpoints. Spring Boot's equivalent Cloud Foundry integration gates these endpoints with read_sensitive_data by default.

Impact

Any CF user holding Space Auditor, Space Manager, or Org Auditor role can access the heap dump, environment, and thread dump actuators for any Steeltoe application in their space. A heap dump contains all in-memory data including database passwords, bearer tokens, and VCAP_SERVICES credentials. CF's read_sensitive_data permission, which is specifically designed to gate this access, has no effect.

Affected configuration

• Application is deployed on Cloud Foundry with CF actuator and security middleware active (added automatically by AddAllActuators() when a CF environment is detected).
• The attacker holds a CF role that grants read_basic_data: Space Auditor, Space Manager, or Org Auditor.

Mitigations

If an immediate upgrade is not possible:

• Explicitly set RequiredPermissions = EndpointPermissions.Full in the options for HeapDumpEndpointOptions, EnvironmentEndpointOptions, and ThreadDumpEndpointOptions.
• If heap dump, thread dump, or environment are not needed in production, register only the required actuators individually instead of using AddAllActuators().

Summary

The Sanitizer component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (password, secret, key, token, .*credentials.*, vcap_services) does not cover the standard .NET pattern ConnectionStrings:<name> or Steeltoe Connectors' Steeltoe:Client:<type>:Default:ConnectionString. There is no value-based scrubbing, so full connection string values including embedded Password= and user:pass@host segments are returned verbatim in /actuator/env responses.

Impact

Any caller who can reach /actuator/env can receive connection strings containing plaintext credentials. Those credentials enable direct connection to the backing database, bypassing the application tier.

Affected configuration

• Application configuration contains credentials in ConnectionStrings:* or *:ConnectionString keys.
• On standard deployments: env is added to Management:Endpoints:Actuator:Exposure:Include. This is not the default.
• On Cloud Foundry: the /cloudfoundryapplication/env path is accessible to any authenticated CF user with read_basic_data permissions (Space Auditor and above) regardless of the exposure configuration.

Mitigations

If an immediate upgrade is not possible:

• On the standard path, remove env from the actuator exposure list.
• Add .*connectionstring.* to KeysToSanitize as a defense-in-depth measure for both paths.
• Require authorization on actuator endpoints.

Summary

When Steeltoe management endpoints are configured to listen on an alternate port (Management:Endpoints:Port is configured), the middleware responsible for restricting access to the endpoints uses the Host HTTP header rather than the actual network socket port.

Impact

An unauthenticated remote attacker can reach every actuator endpoint using a specially crafted HTTP request.

Affected configuration

• The application's public port is accessible over from the network.
• Management:Endpoints:Port is configured to a value different from the application's main listener port.
• The request scheme matches Management:Endpoints:SslEnabled. For example, http when SslEnabled is false (the default), or https when SslEnabled is true.

Mitigations

If an immediate upgrade to a patched version is not possible:

• Add explicit ASP.NET Core authorization (RequireAuthorization) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation.
• Configure the reverse proxy or load balancer to enforce the Host header value and prevent clients from setting an arbitrary port.

Summary

Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI (inline user:password@host credentials) and does not inspect the query string. With IncludeQueryString enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the uri field of the response and written to logs at DEBUG level.

Impact

Any caller who can reach /actuator/httpexchanges can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the Steeltoe.Management.Endpoint.Actuators.HttpExchanges namespace also write these URIs to their application logs.

Affected configuration

• httpexchanges is explicitly added to the actuator exposure list (Management:Endpoints:Web:Exposure:Include). It is not included by default.
• The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links.
• DEBUG logging is enabled for Steeltoe.Management.Endpoint.Actuators.HttpExchanges (log exposure only).

Mitigations

If an immediate upgrade is not possible:

• Remove httpexchanges from the actuator exposure list, or restrict it behind authentication.
• Set Management:Endpoints:HttpExchanges:IncludeQueryString to false to strip query strings from recorded exchanges entirely.

Summary

All Steeltoe actuator endpoints default to EndpointPermissions.Restricted, which is mapped to Cloud Foundry's read_basic_data permission (granted to Space Auditors and similar low-trust roles). Sensitive actuators including heap dump, environment, and thread dump do not raise this to EndpointPermissions.Full, so CF's read_sensitive_data permission flag is not enforced for those endpoints. Spring Boot's equivalent Cloud Foundry integration gates these endpoints with read_sensitive_data by default.

Impact

Any CF user holding Space Auditor, Space Manager, or Org Auditor role can access the heap dump, environment, and thread dump actuators for any Steeltoe application in their space. A heap dump contains all in-memory data including database passwords, bearer tokens, and VCAP_SERVICES credentials. CF's read_sensitive_data permission, which is specifically designed to gate this access, has no effect.

Affected configuration

• Application is deployed on Cloud Foundry with CF actuator and security middleware active (added automatically by AddAllActuators() when a CF environment is detected).
• The attacker holds a CF role that grants read_basic_data: Space Auditor, Space Manager, or Org Auditor.

Mitigations

If an immediate upgrade is not possible:

• Explicitly set RequiredPermissions = EndpointPermissions.Full in the options for HeapDumpEndpointOptions, EnvironmentEndpointOptions, and ThreadDumpEndpointOptions.
• If heap dump, thread dump, or environment are not needed in production, register only the required actuators individually instead of using AddAllActuators().

Summary

The Sanitizer component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (password, secret, key, token, .*credentials.*, vcap_services) does not cover the standard .NET pattern ConnectionStrings:<name> or Steeltoe Connectors' Steeltoe:Client:<type>:Default:ConnectionString. There is no value-based scrubbing, so full connection string values including embedded Password= and user:pass@host segments are returned verbatim in /actuator/env responses.

Impact

Any caller who can reach /actuator/env can receive connection strings containing plaintext credentials. Those credentials enable direct connection to the backing database, bypassing the application tier.

Affected configuration

• Application configuration contains credentials in ConnectionStrings:* or *:ConnectionString keys.
• On standard deployments: env is added to Management:Endpoints:Actuator:Exposure:Include. This is not the default.
• On Cloud Foundry: the /cloudfoundryapplication/env path is accessible to any authenticated CF user with read_basic_data permissions (Space Auditor and above) regardless of the exposure configuration.

Mitigations

If an immediate upgrade is not possible:

• On the standard path, remove env from the actuator exposure list.
• Add .*connectionstring.* to KeysToSanitize as a defense-in-depth measure for both paths.
• Require authorization on actuator endpoints.

Summary

When Steeltoe management endpoints are configured to listen on an alternate port (Management:Endpoints:Port is configured), the middleware responsible for restricting access to the endpoints uses the Host HTTP header rather than the actual network socket port.

Impact

An unauthenticated remote attacker can reach every actuator endpoint using a specially crafted HTTP request.

Affected configuration

• The application's public port is accessible over from the network.
• Management:Endpoints:Port is configured to a value different from the application's main listener port.
• The request scheme matches Management:Endpoints:SslEnabled. For example, http when SslEnabled is false (the default), or https when SslEnabled is true.

Mitigations

If an immediate upgrade to a patched version is not possible:

• Add explicit ASP.NET Core authorization (RequireAuthorization) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation.
• Configure the reverse proxy or load balancer to enforce the Host header value and prevent clients from setting an arbitrary port.

Summary

Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI (inline user:password@host credentials) and does not inspect the query string. With IncludeQueryString enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the uri field of the response and written to logs at DEBUG level.

Impact

Any caller who can reach /actuator/httpexchanges can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the Steeltoe.Management.Endpoint.Actuators.HttpExchanges namespace also write these URIs to their application logs.

Affected configuration

• httpexchanges is explicitly added to the actuator exposure list (Management:Endpoints:Web:Exposure:Include). It is not included by default.
• The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links.
• DEBUG logging is enabled for Steeltoe.Management.Endpoint.Actuators.HttpExchanges (log exposure only).

Mitigations

If an immediate upgrade is not possible:

• Remove httpexchanges from the actuator exposure list, or restrict it behind authentication.
• Set Management:Endpoints:HttpExchanges:IncludeQueryString to false to strip query strings from recorded exchanges entirely.

Summary

All Steeltoe actuator endpoints default to EndpointPermissions.Restricted, which is mapped to Cloud Foundry's read_basic_data permission (granted to Space Auditors and similar low-trust roles). Sensitive actuators including heap dump, environment, and thread dump do not raise this to EndpointPermissions.Full, so CF's read_sensitive_data permission flag is not enforced for those endpoints. Spring Boot's equivalent Cloud Foundry integration gates these endpoints with read_sensitive_data by default.

Impact

Any CF user holding Space Auditor, Space Manager, or Org Auditor role can access the heap dump, environment, and thread dump actuators for any Steeltoe application in their space. A heap dump contains all in-memory data including database passwords, bearer tokens, and VCAP_SERVICES credentials. CF's read_sensitive_data permission, which is specifically designed to gate this access, has no effect.

Affected configuration

• Application is deployed on Cloud Foundry with CF actuator and security middleware active (added automatically by AddAllActuators() when a CF environment is detected).
• The attacker holds a CF role that grants read_basic_data: Space Auditor, Space Manager, or Org Auditor.

Mitigations

If an immediate upgrade is not possible:

• Explicitly set RequiredPermissions = EndpointPermissions.Full in the options for HeapDumpEndpointOptions, EnvironmentEndpointOptions, and ThreadDumpEndpointOptions.
• If heap dump, thread dump, or environment are not needed in production, register only the required actuators individually instead of using AddAllActuators().

Summary

The Sanitizer component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (password, secret, key, token, .*credentials.*, vcap_services) does not cover the standard .NET pattern ConnectionStrings:<name> or Steeltoe Connectors' Steeltoe:Client:<type>:Default:ConnectionString. There is no value-based scrubbing, so full connection string values including embedded Password= and user:pass@host segments are returned verbatim in /actuator/env responses.

Impact

Any caller who can reach /actuator/env can receive connection strings containing plaintext credentials. Those credentials enable direct connection to the backing database, bypassing the application tier.

Affected configuration

• Application configuration contains credentials in ConnectionStrings:* or *:ConnectionString keys.
• On standard deployments: env is added to Management:Endpoints:Actuator:Exposure:Include. This is not the default.
• On Cloud Foundry: the /cloudfoundryapplication/env path is accessible to any authenticated CF user with read_basic_data permissions (Space Auditor and above) regardless of the exposure configuration.

Mitigations

If an immediate upgrade is not possible:

• On the standard path, remove env from the actuator exposure list.
• Add .*connectionstring.* to KeysToSanitize as a defense-in-depth measure for both paths.
• Require authorization on actuator endpoints.

Summary

When Steeltoe management endpoints are configured to listen on an alternate port (Management:Endpoints:Port is configured), the middleware responsible for restricting access to the endpoints uses the Host HTTP header rather than the actual network socket port.

Impact

An unauthenticated remote attacker can reach every actuator endpoint using a specially crafted HTTP request.

Affected configuration

• The application's public port is accessible over from the network.
• Management:Endpoints:Port is configured to a value different from the application's main listener port.
• The request scheme matches Management:Endpoints:SslEnabled. For example, http when SslEnabled is false (the default), or https when SslEnabled is true.

Mitigations

If an immediate upgrade to a patched version is not possible:

• Add explicit ASP.NET Core authorization (RequireAuthorization) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation.
• Configure the reverse proxy or load balancer to enforce the Host header value and prevent clients from setting an arbitrary port.

Summary

Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI (inline user:password@host credentials) and does not inspect the query string. With IncludeQueryString enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the uri field of the response and written to logs at DEBUG level.

Impact

Any caller who can reach /actuator/httpexchanges can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the Steeltoe.Management.Endpoint.Actuators.HttpExchanges namespace also write these URIs to their application logs.

Affected configuration

• httpexchanges is explicitly added to the actuator exposure list (Management:Endpoints:Web:Exposure:Include). It is not included by default.
• The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links.
• DEBUG logging is enabled for Steeltoe.Management.Endpoint.Actuators.HttpExchanges (log exposure only).

Mitigations

If an immediate upgrade is not possible:

• Remove httpexchanges from the actuator exposure list, or restrict it behind authentication.
• Set Management:Endpoints:HttpExchanges:IncludeQueryString to false to strip query strings from recorded exchanges entirely.

Summary

All Steeltoe actuator endpoints default to EndpointPermissions.Restricted, which is mapped to Cloud Foundry's read_basic_data permission (granted to Space Auditors and similar low-trust roles). Sensitive actuators including heap dump, environment, and thread dump do not raise this to EndpointPermissions.Full, so CF's read_sensitive_data permission flag is not enforced for those endpoints. Spring Boot's equivalent Cloud Foundry integration gates these endpoints with read_sensitive_data by default.

Impact

Any CF user holding Space Auditor, Space Manager, or Org Auditor role can access the heap dump, environment, and thread dump actuators for any Steeltoe application in their space. A heap dump contains all in-memory data including database passwords, bearer tokens, and VCAP_SERVICES credentials. CF's read_sensitive_data permission, which is specifically designed to gate this access, has no effect.

Affected configuration

• Application is deployed on Cloud Foundry with CF actuator and security middleware active (added automatically by AddAllActuators() when a CF environment is detected).
• The attacker holds a CF role that grants read_basic_data: Space Auditor, Space Manager, or Org Auditor.

Mitigations

If an immediate upgrade is not possible:

• Explicitly set RequiredPermissions = EndpointPermissions.Full in the options for HeapDumpEndpointOptions, EnvironmentEndpointOptions, and ThreadDumpEndpointOptions.
• If heap dump, thread dump, or environment are not needed in production, register only the required actuators individually instead of using AddAllActuators().

Summary

The Sanitizer component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (password, secret, key, token, .*credentials.*, vcap_services) does not cover the standard .NET pattern ConnectionStrings:<name> or Steeltoe Connectors' Steeltoe:Client:<type>:Default:ConnectionString. There is no value-based scrubbing, so full connection string values including embedded Password= and user:pass@host segments are returned verbatim in /actuator/env responses.

Impact

Any caller who can reach /actuator/env can receive connection strings containing plaintext credentials. Those credentials enable direct connection to the backing database, bypassing the application tier.

Affected configuration

• Application configuration contains credentials in ConnectionStrings:* or *:ConnectionString keys.
• On standard deployments: env is added to Management:Endpoints:Actuator:Exposure:Include. This is not the default.
• On Cloud Foundry: the /cloudfoundryapplication/env path is accessible to any authenticated CF user with read_basic_data permissions (Space Auditor and above) regardless of the exposure configuration.

Mitigations

If an immediate upgrade is not possible:

• On the standard path, remove env from the actuator exposure list.
• Add .*connectionstring.* to KeysToSanitize as a defense-in-depth measure for both paths.
• Require authorization on actuator endpoints.

Summary

When Steeltoe management endpoints are configured to listen on an alternate port (Management:Endpoints:Port is configured), the middleware responsible for restricting access to the endpoints uses the Host HTTP header rather than the actual network socket port.

Impact

An unauthenticated remote attacker can reach every actuator endpoint using a specially crafted HTTP request.

Affected configuration

• The application's public port is accessible over from the network.
• Management:Endpoints:Port is configured to a value different from the application's main listener port.
• The request scheme matches Management:Endpoints:SslEnabled. For example, http when SslEnabled is false (the default), or https when SslEnabled is true.

Mitigations

If an immediate upgrade to a patched version is not possible:

• Add explicit ASP.NET Core authorization (RequireAuthorization) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation.
• Configure the reverse proxy or load balancer to enforce the Host header value and prevent clients from setting an arbitrary port.

Summary

Steeltoe's /actuator/httpexchanges endpoint records and displays request URIs after passing them through MaskedUri. The masking only covers the UserInfo portion of the URI (inline user:password@host credentials) and does not inspect the query string. With IncludeQueryString enabled by default, any secrets carried in query strings (for example: OAuth tokens, password-reset tokens, signed-URL signatures, API keys) are returned verbatim in the uri field of the response and written to logs at DEBUG level.

Impact

Any caller who can reach /actuator/httpexchanges can receive full request URIs from prior traffic, including any secrets those URIs contained in their query strings. Applications with DEBUG-level logging enabled for the Steeltoe.Management.Endpoint.Actuators.HttpExchanges namespace also write these URIs to their application logs.

Affected configuration

• httpexchanges is explicitly added to the actuator exposure list (Management:Endpoints:Web:Exposure:Include). It is not included by default.
• The application handles requests that carry secrets in query strings, such as OAuth callbacks, signed URLs, or password-reset links.
• DEBUG logging is enabled for Steeltoe.Management.Endpoint.Actuators.HttpExchanges (log exposure only).

Mitigations

If an immediate upgrade is not possible:

• Remove httpexchanges from the actuator exposure list, or restrict it behind authentication.
• Set Management:Endpoints:HttpExchanges:IncludeQueryString to false to strip query strings from recorded exchanges entirely.

Summary

All Steeltoe actuator endpoints default to EndpointPermissions.Restricted, which is mapped to Cloud Foundry's read_basic_data permission (granted to Space Auditors and similar low-trust roles). Sensitive actuators including heap dump, environment, and thread dump do not raise this to EndpointPermissions.Full, so CF's read_sensitive_data permission flag is not enforced for those endpoints. Spring Boot's equivalent Cloud Foundry integration gates these endpoints with read_sensitive_data by default.

Impact

Any CF user holding Space Auditor, Space Manager, or Org Auditor role can access the heap dump, environment, and thread dump actuators for any Steeltoe application in their space. A heap dump contains all in-memory data including database passwords, bearer tokens, and VCAP_SERVICES credentials. CF's read_sensitive_data permission, which is specifically designed to gate this access, has no effect.

Affected configuration

• Application is deployed on Cloud Foundry with CF actuator and security middleware active (added automatically by AddAllActuators() when a CF environment is detected).
• The attacker holds a CF role that grants read_basic_data: Space Auditor, Space Manager, or Org Auditor.

Mitigations

If an immediate upgrade is not possible:

• Explicitly set RequiredPermissions = EndpointPermissions.Full in the options for HeapDumpEndpointOptions, EnvironmentEndpointOptions, and ThreadDumpEndpointOptions.
• If heap dump, thread dump, or environment are not needed in production, register only the required actuators individually instead of using AddAllActuators().

Summary

The Sanitizer component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (password, secret, key, token, .*credentials.*, vcap_services) does not cover the standard .NET pattern ConnectionStrings:<name> or Steeltoe Connectors' Steeltoe:Client:<type>:Default:ConnectionString. There is no value-based scrubbing, so full connection string values including embedded Password= and user:pass@host segments are returned verbatim in /actuator/env responses.

Impact

Any caller who can reach /actuator/env can receive connection strings containing plaintext credentials. Those credentials enable direct connection to the backing database, bypassing the application tier.

Affected configuration

• Application configuration contains credentials in ConnectionStrings:* or *:ConnectionString keys.
• On standard deployments: env is added to Management:Endpoints:Actuator:Exposure:Include. This is not the default.
• On Cloud Foundry: the /cloudfoundryapplication/env path is accessible to any authenticated CF user with read_basic_data permissions (Space Auditor and above) regardless of the exposure configuration.

Mitigations

If an immediate upgrade is not possible:

• On the standard path, remove env from the actuator exposure list.
• Add .*connectionstring.* to KeysToSanitize as a defense-in-depth measure for both paths.
• Require authorization on actuator endpoints.

Summary

When Steeltoe management endpoints are configured to listen on an alternate port (Management:Endpoints:Port is configured), the middleware responsible for restricting access to the endpoints uses the Host HTTP header rather than the actual network socket port.

Impact

An unauthenticated remote attacker can reach every actuator endpoint using a specially crafted HTTP request.

Affected configuration

• The application's public port is accessible over from the network.
• Management:Endpoints:Port is configured to a value different from the application's main listener port.
• The request scheme matches Management:Endpoints:SslEnabled. For example, http when SslEnabled is false (the default), or https when SslEnabled is true.

Mitigations

If an immediate upgrade to a patched version is not possible:

• Add explicit ASP.NET Core authorization (RequireAuthorization) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation.
• Configure the reverse proxy or load balancer to enforce the Host header value and prevent clients from setting an arbitrary port.