Steeltoe Configuration Encryption EUVD-2026-37821

Exploitation requires all of the following: (1) the application must be running Steeltoe.Configuration.Encryption 4.0.0 or 4.1.0 with encrypt:rsa:algorithm=OAEP explicitly configured - without this setting, there is no security expectation differential; (2) the attacker must have obtained RSA-encrypted ciphertext from the affected system; (3) the attacker must have access to a decryption oracle capable of leaking padding-validation behavior to conduct a Bleichenbacher adaptive chosen-ciphertext attack; (4) the CVSS vector (AV:L/AC:H/PR:H) further limits exploitation to high-privilege local actors, meaning an insider or an attacker who has already achieved privileged local access. What limits exploitation: the attacker cannot exploit this remotely without a separately accessible decryption oracle; no special network exposure or user interaction is required beyond the above; the vulnerability does not enable direct code execution or privilege escalation.

The CVSS 3.1 base score of 1.9 (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) accurately reflects the narrow exploitation path: an attacker must already have high-privilege local access to the system and face high attack complexity to extract any benefit from the weaker padding scheme. No EPSS data was provided, no CISA KEV listing exists, and no public exploit code has been identified. The real-world risk is principally a cryptographic guarantee failure rather than an immediately weaponizable flaw: operators who deliberately chose OAEP over PKCS#1 v1.5 - likely because they were aware of padding oracle risks in their threat model - received no such protection. If an adversary has obtained encrypted ciphertext (e.g., from a leaked config server backup) and has a decryption oracle, the PKCS#1 v1.5 ciphertext is more tractable to attack than OAEP would have been. For most deployments the practical risk increment is low, but for environments with elevated sensitivity around configuration secrets (database credentials, API keys, certificates), the failure to apply the stronger algorithm as configured is a meaningful gap. No conflicting signals exist between data sources - CVSS, description, and commit diff are internally consistent.

An attacker who has exfiltrated RSA-encrypted configuration blobs from a Spring Cloud Config Server (e.g., via a separate path-traversal or backup leak) and who can submit adaptive chosen-ciphertext queries to a decryption oracle (such as a misconfigured or compromised service endpoint that reveals padding errors) could execute a Bleichenbacher-style attack against ciphertexts that were supposed to be OAEP-protected but were actually encrypted under PKCS#1 v1.5. No public exploit or proof-of-concept targeting this specific vulnerability has been identified; successful exploitation requires substantial cryptographic capability and oracle access.