Read the docs
TI-2024-27048 Aliases CVE-2024-40636GHSA-vmcp-66r5-3pcp

Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness

Priority MEDIUM 63CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. The code in question is `_logger.LogError(e, "FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());` in the `DiscoveryClient.cs` file which may leak credentials into logs. This issue has been addressed in version 3.2.8 of the Steeltoe.Discovery.Eureka nuget package.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00418 36th percentileScored 2026-11-07
Fix Fixed security-advisories (SteeltoeOSS): 3.2.8Steeltoe.Discovery.Eureka (NuGet): 3.2.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SteeltoeOSSsecurity-advisoriesbefore 3.2.83.2.8Patch availableCNA
—Steeltoe.Discovery.Eureka (NuGet)before 3.2.83.2.8Patch availableGHSA-vmcp-66r5-3pcp
—Steeltoe.Discovery.EurekaBase (NuGet)up to 2.5.5—No fix listedGHSA-vmcp-66r5-3pcp
—Steeltoe.Discovery.ClientCore (NuGet)all versions—No fix listedGHSA-vmcp-66r5-3pcp
—Steeltoe.Discovery.ClientAutofac (NuGet)up to 2.5.5—No fix listedGHSA-vmcp-66r5-3pcp
  • security-advisories VendorSteeltoeOSS Affected before 3.2.8 Fixed in 3.2.8 Patch available CNA
  • Steeltoe.Discovery.Eureka (NuGet) Vendor— Affected before 3.2.8 Fixed in 3.2.8 Patch available GHSA-vmcp-66r5-3pcp
  • Steeltoe.Discovery.EurekaBase (NuGet) Vendor— Affected up to 2.5.5 Fixed in — No fix listed GHSA-vmcp-66r5-3pcp
  • Steeltoe.Discovery.ClientCore (NuGet) Vendor— Affected all versions Fixed in — No fix listed GHSA-vmcp-66r5-3pcp
  • Steeltoe.Discovery.ClientAutofac (NuGet) Vendor— Affected up to 2.5.5 Fixed in — No fix listed GHSA-vmcp-66r5-3pcp

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:steeltoeoss:discovery:*:*:*:*:*:*:*:*——SteeltoeOSS
  • cpe:2.3:a:steeltoeoss:discovery:*:*:*:*:*:*:*:* Versions — — ·SteeltoeOSS

Remediation

  • Fix · CNA security-advisories (SteeltoeOSS) Fixed in 3.2.8
  • Fix · GHSA-vmcp-66r5-3pcp Steeltoe.Discovery.Eureka (NuGet) Fixed in 3.2.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-40636
  2. 2026-10-03 Alias added: GHSA-vmcp-66r5-3pcp

References

Advisory 1

Other 3

  • TI-2026-36953 Steeltoe vulnerable to management-port isolation bypass via spoofed Host header CVSS 3.1HIGH 8.2
  • TI-2026-56238 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) CVSS 3.1HIGH 7.5
  • TI-2026-56237 Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) CVSS 3.1HIGH 7.5
  • TI-2026-36955 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch CVSS 3.1HIGH 7.5
  • TI-2026-36959 Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords CVSS 3.1HIGH 7.5
  • TI-2026-56482 Steeltoe: Header-forwarded client cert lacks proof of private-key possession CVSS 3.1MEDIUM 6.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences