CVE-2026-50267

{
  "id": "CVE-2026-50267",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-17T23:17:04.590",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstractions 4.0.0 through 4.1.0, when MySQL or PostgreSQL service bindings from `VCAP_SERVICES` include TLS client credentials, the Connectors library writes those credentials to temporary files in `Path.GetTempPath()` using `File.CreateText`. On Linux, `File.CreateText` creates files with mode `0644` (world-readable) under the process umask, and the files are never deleted. The same key material is protected at mode `0400` in `/proc/<pid>/environ`. Steeltoe.Configuration.Abstractions version 4.2.0 patches the issue. If an immediate upgrade is not possible, prevent other processes from running in the container under a different UID with access to `/tmp`."
    },
    {
      "lang": "es",
      "value": "Steeltoe es un proyecto de código abierto que proporciona una colección de bibliotecas que ayuda a los usuarios a construir aplicaciones nativas de la nube. En Steeltoe.Configuration.Abstractions 4.0.0 hasta 4.1.0, cuando los enlaces de servicio de MySQL o PostgreSQL de ’VCAP_SERVICES’ incluyen credenciales de cliente TLS, la biblioteca Connectors escribe esas credenciales en archivos temporales en ’Path.GetTempPath()’ usando ’File.CreateText’. En Linux, ’File.CreateText’ crea archivos con modo ’0644’ (legibles por todos) bajo la umask del proceso, y los archivos nunca se eliminan. El mismo material de clave está protegido en modo ’0400’ en ’/proc/[pid]/environ’. Steeltoe.Configuration.Abstractions versión 4.2.0 corrige el problema. Si una actualización inmediata no es posible, evite que otros procesos se ejecuten en el contenedor bajo un UID diferente con acceso a ’/tmp’."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SteeltoeOSS",
          "product": "Steeltoe.Configuration.Abstractions",
          "versions": [
            {
              "version": ">= 4.0.0, < 4.2.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-18T19:10:46.830420Z",
          "id": "CVE-2026-50267",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        },
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/SteeltoeOSS/Steeltoe/commit/8dd97cc6c4b184121a4bd1f92f9ac16918433471",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-rxrh-4j9h-xgg9",
      "source": "[email protected]"
    }
  ]
}