Vulnerability · Published Jun 17, 2026 · Assigned by GitHub_M
CVE-2026-50267Steeltoe: TLS private keys written to /tmp with default permissions, never deleted
Medium 4.7
In plain English
A medium-severity incorrect permission assignment in Steeltoe.Configuration.Abstractions from SteeltoeOSS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstractions 4.0.0 through 4.1.0, when MySQL or PostgreSQL service bindings from `VCAP_SERVICES` include TLS client credentials, the Connectors library writes those credentials to temporary files in `Path.GetTempPath()` using `File.CreateText`. On Linux, `File.CreateText` creates files with mode `0644` (world-readable) under the process umask, and the files are never deleted. The same key material is protected at mode `0400` in `/proc/<pid>/environ`. Steeltoe.Configuration.Abstractions version 4.2.0 patches the issue. If an immediate upgrade is not possible, prevent other processes from running in the container under a different UID with access to `/tmp`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | steeltoe.configuration.abstractions | 4.2.0 | GHSA-rxrh-4j9h-xgg9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SteeltoeOSS | Steeltoe.Configuration.Abstractions | >= 4.0.0, < 4.2.0 |
Weakness: CWE-312, CWE-732 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N