What is the CVSS score of CVE-2026-50267?

CVE-2026-50267 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-50267?

Yes, a patch is available for CVE-2026-50267. Update the affected software to the latest version immediately.

Steeltoe Configuration CVE-2026-50267

EUVD-2026-37820 MEDIUM

Cleartext Storage of Sensitive Information (CWE-312)

2026-06-17 GitHub_M

GHSA-rxrh-4j9h-xgg9

Information Disclosure PostgreSQL Steeltoe Configuration Abstractions Steeltoeoss

4.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.7 MEDIUM

Local attack vector and a separately-UID'd co-process in /tmp are required, justifying AV:L and AC:H; exposed TLS private keys warrant C:H with no integrity or availability impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 02, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Jun 17, 2026 - 23:06 vuln.today

Analysis Generated

Jun 17, 2026 - 23:06 vuln.today

DescriptionCVE.org

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstractions 4.0.0 through 4.1.0, when MySQL or PostgreSQL service bindings from VCAP_SERVICES include TLS client credentials, the Connectors library writes those credentials to temporary files in Path.GetTempPath() using File.CreateText. On Linux, File.CreateText creates files with mode 0644 (world-readable) under the process umask, and the files are never deleted. The same key material is protected at mode 0400 in /proc/<pid>/environ. Steeltoe.Configuration.Abstractions version 4.2.0 patches the issue. If an immediate upgrade is not possible, prevent other processes from running in the container under a different UID with access to /tmp.

AnalysisAI

Steeltoe.Configuration.Abstractions 4.0.0-4.1.0 permanently exposes TLS client private key material to world-readable temporary files on Linux when Cloud Foundry MySQL or PostgreSQL service bindings supply SSL credentials via VCAP_SERVICES. The Connectors library writes SSL certificate, private key, and CA files to Path.GetTempPath() using File.CreateText, which on Linux creates files at mode 0644 (owner read/write, group read, world read) with no cleanup mechanism, leaving key material readable by any co-located process for the container's lifetime. Vendor-released patch 4.2.0 resolves both the permission issue (restricting new temp files to mode 0600) and the missing cleanup via IDisposable; no public exploit has been identified at time of analysis.

Technical ContextAI

The root cause is CWE-312 (Cleartext Storage of Sensitive Information in an Insufficiently Protected Location). The affected library, Steeltoe.Configuration.Abstractions (CPE: cpe:2.3:a:steeltoeoss:steeltoe.configuration.abstractions:*:*:*:*:*:*:*:*), processes Cloud Foundry's VCAP_SERVICES environment variable to extract service binding credentials and map them to .NET configuration. For MySQL and PostgreSQL bindings that include mTLS client credentials (ssl-cert, ssl-key, ssl-ca for MySQL; SSL Certificate, SSL Key, Root Certificate for PostgreSQL), CloudFoundryPostProcessor implementations call mapper.MapFromToFile(), which writes PEM-encoded credential data to files in Path.GetTempPath() (typically /tmp on Linux) via the .NET File.CreateText API. Unlike Windows, Linux does not restrict file permissions in File.CreateText beyond the process umask, so files land at mode 0644 - world-readable. Compounding this, the post-processors never tracked the created paths, so no cleanup occurred on application shutdown. The fix in commit 8dd97cc introduces a CreateTempFile helper that uses FileStreamOptions.UnixCreateMode = UserRead | UserWrite (0600) on non-Windows platforms, and adds IDisposable implementations across PostProcessorConfigurationProvider and CloudFoundryPostProcessor to delete tracked temp paths on disposal.

RemediationAI

Upgrade to Steeltoe.Configuration.Abstractions 4.2.0, which is the vendor-released patch that resolves both the insecure file permissions (switching to mode 0600 via FileStreamOptions.UnixCreateMode on Linux) and the missing temp-file cleanup (IDisposable pattern across CloudFoundryPostProcessor and PostProcessorConfigurationProvider). The fix is confirmed by upstream commit https://github.com/SteeltoeOSS/Steeltoe/commit/8dd97cc6c4b184121a4bd1f92f9ac16918433471 and vendor advisory https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-rxrh-4j9h-xgg9. If an immediate upgrade is not possible, the vendor-recommended compensating control is to ensure no other processes run in the container under a different UID with access to /tmp - achievable by enforcing a single non-root UID for all container processes, configuring Linux user namespaces to isolate UID space, or remounting /tmp as a private tmpfs accessible only to the application user (note: a private tmpfs mount prevents other users from reading the files but does not address the persistence issue). Rotating any TLS client credentials that may have been exposed while the vulnerable version was running should also be considered, as the files were never deleted and may remain on disk.