PT-2026-50567 · Steeltoeoss · Steeltoe.Configuration.Abstractions

Publicado 2026-06-17 · Atualizado 2026-06-17 · CVE-2026-50267

Mitre

CVSS v3.1

4.7

Média

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstractions 4.0.0 through 4.1.0, when MySQL or PostgreSQL service bindings from VCAP SERVICES include TLS client credentials, the Connectors library writes those credentials to temporary files in Path.GetTempPath() using File.CreateText. On Linux, File.CreateText creates files with mode 0644 (world-readable) under the process umask, and the files are never deleted. The same key material is protected at mode 0400 in /proc/<pid>/environ. Steeltoe.Configuration.Abstractions version 4.2.0 patches the issue. If an immediate upgrade is not possible, prevent other processes from running in the container under a different UID with access to /tmp.

Correção

Incorrect Permission

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-732

CWE-312

Identificadores relacionados

CVE-2026-50267

Produtos afetados

Steeltoe.Configuration.Abstractions

Referências · 2

• https://github.com/SteeltoeOSS/Steeltoe/commit/8dd97cc6c4b184121a4bd1f92f9ac16918433471 · Nota
• https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-rxrh-4j9h-xgg9 · Nota