diff --git a/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/ConfigurationPropertiesReportEndpoint.java b/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/ConfigurationPropertiesReportEndpoint.java
index a8ddab578d..f9c8424aff 100644
--- a/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/ConfigurationPropertiesReportEndpoint.java
+++ b/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/ConfigurationPropertiesReportEndpoint.java
@@ -259,10 +259,9 @@ public class ConfigurationPropertiesReportEndpoint
 				sanitized.add(sanitize(prefix, (Map<String, Object>) item));
 			}
 			else if (item instanceof List) {
-				sanitize(prefix, (List<Object>) item);
+				sanitized.add(sanitize(prefix, (List<Object>) item));
 			}
 			else {
-				item = this.sanitizer.sanitize(prefix, item);
 				sanitized.add(this.sanitizer.sanitize(prefix, item));
 			}
 		}
diff --git a/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/ConfigurationPropertiesReportEndpointTests.java b/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/ConfigurationPropertiesReportEndpointTests.java
index d29c14167d..a866e79fa6 100644
--- a/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/ConfigurationPropertiesReportEndpointTests.java
+++ b/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/ConfigurationPropertiesReportEndpointTests.java
@@ -17,6 +17,7 @@
 package org.springframework.boot.actuate.endpoint;
 
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -212,6 +213,23 @@ public class ConfigurationPropertiesReportEndpointTests
 		assertThat(item.get("somePassword")).isEqualTo("******");
 	}
 
+	@Test
+	@SuppressWarnings("unchecked")
+	public void listsOfListsAreSanitized() throws Exception {
+		ConfigurationPropertiesReportEndpoint report = getEndpointBean();
+		Map<String, Object> properties = report.invoke();
+		Map<String, Object> nestedProperties = (Map<String, Object>) ((Map<String, Object>) properties
+				.get("testProperties")).get("properties");
+		assertThat(nestedProperties.get("listOfListItems")).isInstanceOf(List.class);
+		List<List<Object>> listOfLists = (List<List<Object>>) nestedProperties
+				.get("listOfListItems");
+		assertThat(listOfLists).hasSize(1);
+		List<Object> list = listOfLists.get(0);
+		assertThat(list).hasSize(1);
+		Map<String, Object> item = (Map<String, Object>) list.get(0);
+		assertThat(item.get("somePassword")).isEqualTo("******");
+	}
+
 	@Configuration
 	@EnableConfigurationProperties
 	public static class Parent {
@@ -254,10 +272,13 @@ public class ConfigurationPropertiesReportEndpointTests
 
 		private List<ListItem> listItems = new ArrayList<ListItem>();
 
+		private List<List<ListItem>> listOfListItems = new ArrayList<List<ListItem>>();
+
 		public TestProperties() {
 			this.secrets.put("mine", "myPrivateThing");
 			this.secrets.put("yours", "yourPrivateThing");
 			this.listItems.add(new ListItem());
+			this.listOfListItems.add(Arrays.asList(new ListItem()));
 		}
 
 		public String getDbPassword() {
@@ -308,6 +329,14 @@ public class ConfigurationPropertiesReportEndpointTests
 			this.listItems = listItems;
 		}
 
+		public List<List<ListItem>> getListOfListItems() {
+			return this.listOfListItems;
+		}
+
+		public void setListOfListItems(List<List<ListItem>> listOfListItems) {
+			this.listOfListItems = listOfListItems;
+		}
+
 		public static class Hidden {
 
 			private String mine = "mySecret";