TI-2026-37010 Aliases CVE-2026-50267 GHSA-rxrh-4j9h-xgg9

Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

LOW 20CWE-312Published 2026-06-17 · Updated 2026-06-18

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-312.

Summary

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstractions 4.0.0 through 4.1.0, when MySQL or PostgreSQL service bindings from `VCAP_SERVICES` include TLS client credentials, the Connectors library writes those credentials to temporary files in `Path.GetTempPath()` using `File.CreateText`. On Linux, `File.CreateText` creates files with mode `0644` (world-readable) under the process umask, and the files are never deleted. The same key material is protected at mode `0400` in `/proc/<pid>/environ`. Steeltoe.Configuration.Abstractions version 4.2.0 patches the issue. If an immediate upgrade is not possible, prevent other processes from running in the container under a different UID with access to `/tmp`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00065 0th percentileScored 2026-11-07

Fix Fixed Steeltoe.Configuration.Abstractions (SteeltoeOSS): 4.2.0Steeltoe.Configuration.Abstractions (NuGet): 4.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SteeltoeOSS	Steeltoe.Configuration.Abstractions	4.0.0 to before 4.2.0	4.2.0	Patch available	CNA
—	Steeltoe.Configuration.Abstractions (NuGet)	4.0.0 to before 4.2.0	4.2.0	Patch available	GHSA-rxrh-4j9h-xgg9

Steeltoe.Configuration.Abstractions VendorSteeltoeOSS Affected 4.0.0 to before 4.2.0 Fixed in 4.2.0 Patch available CNA
Steeltoe.Configuration.Abstractions (NuGet) Vendor— Affected 4.0.0 to before 4.2.0 Fixed in 4.2.0 Patch available GHSA-rxrh-4j9h-xgg9

Remediation

Fix · CNA Steeltoe.Configuration.Abstractions (SteeltoeOSS) Fixed in 4.2.0
Fix · GHSA-rxrh-4j9h-xgg9 Steeltoe.Configuration.Abstractions (NuGet) Fixed in 4.2.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-50267
2026-10-03 Alias added: GHSA-rxrh-4j9h-xgg9

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-50267

Other 3

TI-2024-27048 Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness CVSS 3.1MEDIUM 5.3
TI-2026-36953 Steeltoe vulnerable to management-port isolation bypass via spoofed Host header CVSS 3.1HIGH 8.2
TI-2026-56238 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) CVSS 3.1HIGH 7.5
TI-2026-56237 Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) CVSS 3.1HIGH 7.5
TI-2026-36955 Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch CVSS 3.1HIGH 7.5
TI-2026-36959 Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords CVSS 3.1HIGH 7.5

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences