CVE-2026-50267: Steeltoe Information Disclosure Flaw

CVE-2026-50267 Overview

CVE-2026-50267 affects Steeltoe, an open source project providing libraries for building cloud-native .NET applications. The Steeltoe Connectors library writes TLS client credentials from MySQL and PostgreSQL service bindings to temporary files with world-readable permissions on Linux. The flaw maps to CWE-312: Cleartext Storage of Sensitive Information. Affected versions include Steeltoe.Configuration.Abstractions 4.0.0 through 4.1.0, with the fix shipping in 4.2.0.

Critical Impact
Any local process running under a different UID with access to /tmp can read TLS client keys and certificates intended for database authentication, enabling credential theft and downstream database impersonation.

Affected Products

Steeltoe.Configuration.Abstractions 4.0.0
Steeltoe.Configuration.Abstractions 4.1.0
Steeltoe Connectors using MySQL or PostgreSQL service bindings from VCAP_SERVICES

Discovery Timeline

2026-06-17 - CVE-2026-50267 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50267

Vulnerability Analysis

The Steeltoe Connectors library parses VCAP_SERVICES environment data to extract database service bindings. When MySQL or PostgreSQL bindings carry TLS client credentials, the Connectors write each credential value to a temporary file generated by Path.GetTempPath() and Path.GetRandomFileName(). The code uses File.CreateText to create those files, then never deletes them.

On Linux, File.CreateText creates files with mode 0644 under the default process umask, leaving them world-readable. The same key material exists at /proc/<pid>/environ protected by mode 0400, which restricts access to the process owner. The Connectors library effectively downgrades the protection of secrets that the operating system already isolated.

The attack is local and requires a co-resident process running under a different UID with read access to /tmp. While the access complexity is high, the resulting credential exposure allows the attacker to authenticate to backend databases as the legitimate workload.

Root Cause

The root cause is a missing file permission hardening step. File.CreateText honors the process umask rather than restricting access to the owner. The library never invokes a permission tightening API such as File.SetUnixFileMode and never removes the temporary files after use, persisting the secrets on disk indefinitely.

Attack Vector

An attacker with local code execution in the same container or host, running under any UID with traversal rights to /tmp, enumerates files in the temp directory and reads credentials directly. No authentication to the Steeltoe application is required. The attacker then uses the stolen TLS client material to connect to MySQL or PostgreSQL backends.

text

// Patch in src/Configuration/src/Abstractions/ConfigurationDictionaryMapper.cs
 string tempPath = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName());

-        using (StreamWriter writer = File.CreateText(tempPath))
+        using (StreamWriter writer = CreateTempFile(tempPath))
         {
             writer.Write(value);
         }

Source: GitHub Commit 8dd97cc

text

// Patch in src/Configuration/src/Abstractions/PostProcessorConfigurationProvider.cs
 using Microsoft.Extensions.Configuration;

+#pragma warning disable S3881 // "IDisposable" should be implemented correctly
+
 namespace Steeltoe.Configuration;

-internal abstract class PostProcessorConfigurationProvider : ConfigurationProvider
+internal abstract class PostProcessorConfigurationProvider : ConfigurationProvider, IDisposable
 {
     public PostProcessorConfigurationSource Source { get; }

Source: GitHub Commit 8dd97cc. The provider now implements IDisposable so temporary credential files can be cleaned up rather than orphaned.

Detection Methods for CVE-2026-50267

Indicators of Compromise

Presence of randomly named files in /tmp with mode 0644 containing PEM-formatted keys, certificates, or CA bundles.
Files in Path.GetTempPath() whose contents match BEGIN CERTIFICATE, BEGIN PRIVATE KEY, or BEGIN RSA PRIVATE KEY markers.
Read access to /tmp files by processes running under a UID different from the Steeltoe application owner.

Detection Strategies

Audit running .NET workloads for Steeltoe.Configuration.Abstractions versions 4.0.0 through 4.1.0 in build manifests and Software Bill of Materials.
Use Linux auditd rules to log open and read syscalls on /tmp files containing PEM headers from non-owner UIDs.
Scan container images and live containers for world-readable files under /tmp that contain TLS key material.

Monitoring Recommendations

Monitor outbound database connections originating from unexpected processes or hosts using the credentials issued to Steeltoe workloads.
Alert on cross-UID access to files within /tmp inside containers that run Steeltoe-based services.
Track changes to MySQL and PostgreSQL accounts associated with VCAP_SERVICES bindings for unexpected authentication sources.

How to Mitigate CVE-2026-50267

Immediate Actions Required

Upgrade Steeltoe.Configuration.Abstractions to version 4.2.0 or later across all affected services.
Rotate any TLS client credentials previously bound through VCAP_SERVICES to MySQL or PostgreSQL services.
Delete leftover credential files from /tmp on running hosts and containers after deploying the patched library.

Patch Information

The maintainers released Steeltoe.Configuration.Abstractions 4.2.0, which routes temp file creation through a new CreateTempFile helper and implements IDisposable on PostProcessorConfigurationProvider to remove files after use. Patch details are available in the GitHub Security Advisory GHSA-rxrh-4j9h-xgg9 and the upstream commit.

Workarounds

Run the Steeltoe workload as the only process inside its container so no foreign UID can read /tmp.
Restrict /tmp access by mounting a private tmpfs per container or per service user.
Set a restrictive process umask such as 0077 before starting the application to reduce default file mode exposure.

bash

# Restrict default file permissions for the Steeltoe process
umask 0077

# Remove stale credential files written by vulnerable versions
find /tmp -maxdepth 1 -type f -perm -004 \
    -exec grep -l 'BEGIN \(CERTIFICATE\|PRIVATE KEY\)' {} \; \
    -delete

# Upgrade the Steeltoe package
dotnet add package Steeltoe.Configuration.Abstractions --version 4.2.0