GHSA-rxrh-4j9h-xgg9

Source

https://github.com/advisories/GHSA-rxrh-4j9h-xgg9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-rxrh-4j9h-xgg9/GHSA-rxrh-4j9h-xgg9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rxrh-4j9h-xgg9

Aliases

CVE-2026-50267

Published

2026-07-02T20:32:09Z

Modified

2026-07-02T20:45:16.526358967Z

Severity

4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

Details

Summary

When MySQL or PostgreSQL service bindings from VCAP_SERVICES include TLS client credentials, the Connectors library writes those credentials to temporary files in Path.GetTempPath() using File.CreateText. On Linux, File.CreateText creates files with mode 0644 (world-readable) under the process umask, and the files are never deleted. The same key material is protected at mode 0400 in /proc/<pid>/environ.

Impact

Any process co-located in the container that runs as a different UID can read the TLS client private key from /tmp and use it to impersonate the application when connecting to the backing database over mutual TLS.

Affected configuration

Application is deployed on Cloud Foundry or another environment that populates VCAP_SERVICES with a MySQL or PostgreSQL service binding that includes sslKey credentials.
A process running as a different UID shares the container's filesystem.

Mitigations

If an immediate upgrade is not possible, prevent other processes from running in the container under a different UID with access to /tmp.

Database specific

{
    "github_reviewed_at": "2026-07-02T20:32:09Z",
    "nvd_published_at": "2026-06-17T23:17:04Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-312",
        "CWE-732"
    ],
    "severity": "MODERATE"
}

References

Affected packages

NuGet / Steeltoe.Configuration.Abstractions

Package

Name: Steeltoe.Configuration.Abstractions; View open source insights on deps.dev
Purl: pkg:nuget/Steeltoe.Configuration.Abstractions

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.2.0

Affected versions

4.*

4.0.0

4.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-rxrh-4j9h-xgg9/GHSA-rxrh-4j9h-xgg9.json"

last_known_affected_version_range

"<= 4.1.0"