CVE-2026-50268: Steeltoe Encryption Info Disclosure Flaw

CVE-2026-50268 Overview

CVE-2026-50268 affects Steeltoe.Configuration.Encryption, an open source library used to build cloud-native .NET applications. The vulnerability is a cryptographic algorithm downgrade in versions 4.0.0 through 4.1.0. Setting encrypt:rsa:algorithm=OAEP does not enable Optimal Asymmetric Encryption Padding (OAEP). Instead, an incorrect BouncyCastle transformation string causes the library to select PKCS#1 v1.5 padding, the same algorithm as the DEFAULT setting. The issue is tracked under [CWE-256] and was resolved in Steeltoe.Configuration.Encryption 4.2.0.

Critical Impact
Administrators expecting OAEP-strength RSA padding silently receive PKCS#1 v1.5, weakening the cryptographic posture of encrypted configuration values.

Affected Products

Steeltoe.Configuration.Encryption 4.0.0
Steeltoe.Configuration.Encryption 4.1.0 (and intermediate 4.x versions)
Applications consuming Steeltoe configuration encryption with encrypt:rsa:algorithm=OAEP

Discovery Timeline

2026-06-17 - CVE-2026-50268 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50268

Vulnerability Analysis

The defect resides in RsaKeyStoreDecryptor.cs, which maps algorithm names supplied via configuration to BouncyCastle cipher transformation strings. The mapping for the OAEP option uses the string RSA/ECB/PKCS1, which BouncyCastle interprets as PKCS#1 v1.5 padding rather than OAEP. As a result, both DEFAULT and OAEP configurations resolve to the same PKCS#1 v1.5 cipher.

PKCS#1 v1.5 padding has well-documented weaknesses, including susceptibility to Bleichenbacher-style adaptive chosen-ciphertext attacks. Operators relying on the OAEP setting to meet internal cryptographic policy or compliance requirements receive a weaker primitive without warning. The flaw is a silent downgrade rather than an authentication or remote-access weakness, which is reflected in the local, high-complexity, high-privilege vector.

Root Cause

The root cause is an incorrect BouncyCastle transformation string in the algorithm selection switch. The OAEP branch returned CipherUtilities.GetCipher("RSA/ECB/PKCS1") instead of an OAEP transformation. The string did not raise a parsing error, so the misconfiguration went undetected at runtime.

Attack Vector

An attacker requires local access and elevated privileges to interact with the affected configuration system, limiting practical exploitation. The realistic risk is that encrypted configuration values, such as connection strings or API keys, are protected with weaker padding than the administrator intended. An adversary with ciphertext access and the ability to submit decryption oracles could attempt classical attacks against PKCS#1 v1.5.

text

// Source: https://github.com/SteeltoeOSS/Steeltoe/commit/6cfee5cccddf8f9a31de69b0ca5ccdd771b73e5b
// File: src/Configuration/src/Encryption/Cryptography/RsaKeyStoreDecryptor.cs
// Security patch - Fix unexpected OAEP algorithm downgrade

         return algorithm.ToUpperInvariant() switch
         {
             "DEFAULT" => CipherUtilities.GetCipher("RSA/NONE/PKCS1Padding"),
-            "OAEP" => CipherUtilities.GetCipher("RSA/ECB/PKCS1"),
+            "OAEP" => CipherUtilities.GetCipher("RSA/NONE/OAEPWithSHA1AndMGF1Padding"),
             _ => throw new ArgumentException("algorithm should be one of DEFAULT or OAEP")
         };
     }

The patch replaces the incorrect RSA/ECB/PKCS1 transformation with RSA/NONE/OAEPWithSHA1AndMGF1Padding, enabling true OAEP padding when the OAEP algorithm is selected.

Detection Methods for CVE-2026-50268

Indicators of Compromise

Deployed .NET applications referencing Steeltoe.Configuration.Encryption package versions 4.0.0 through 4.1.x in project files or lockfiles.
Application configuration containing encrypt:rsa:algorithm=OAEP paired with a vulnerable Steeltoe version.
Ciphertexts produced by affected builds that decrypt successfully with a PKCS#1 v1.5 transformation rather than OAEP.

Detection Strategies

Inventory .csproj, packages.lock.json, and SBOM artifacts for the Steeltoe.Configuration.Encryption dependency and flag versions below 4.2.0.
Add a software composition analysis (SCA) rule that maps GHSA-4j9m-h44m-2hv8 to build pipelines and fails builds containing vulnerable versions.
Review configuration repositories for the presence of the OAEP algorithm setting to identify environments where the silent downgrade applies.

Monitoring Recommendations

Track outbound dependency restores in CI logs and alert when vulnerable Steeltoe versions are pulled from NuGet.
Monitor configuration server access patterns for anomalous bulk reads of encrypted values that could indicate ciphertext harvesting.
Periodically re-run dependency scans on long-running services that may not rebuild frequently.

How to Mitigate CVE-2026-50268

Immediate Actions Required

Upgrade Steeltoe.Configuration.Encryption to version 4.2.0 or later in all affected projects.
Rotate any secrets previously encrypted under the OAEP setting, since they were actually protected with PKCS#1 v1.5.
Re-encrypt configuration values using the patched library to ensure OAEP padding is genuinely applied.

Patch Information

The fix is included in Steeltoe.Configuration.Encryption 4.2.0. Refer to the GitHub Security Advisory GHSA-4j9m-h44m-2hv8 and the GitHub Commit Reference for code-level details.

Workarounds

Restrict local and administrative access to hosts running affected Steeltoe services until the upgrade is deployed.
Treat configuration values encrypted by vulnerable versions as PKCS#1 v1.5 protected and apply compensating controls such as network segmentation and access auditing.
Where upgrading is not immediately possible, avoid relying on OAEP as a security guarantee and document the residual risk for compliance reviewers.

bash

# Configuration example - upgrade the Steeltoe encryption package
dotnet add package Steeltoe.Configuration.Encryption --version 4.2.0

# Verify the installed version
dotnet list package | grep Steeltoe.Configuration.Encryption