RUSTSEC-2026-0275

Applications built on the legacy Azure SDK for Rust (azure_core 0.21.0 and earlier) write the value of the outgoing authorization header to their logs whenever debug-level logging is enabled, and in every affected version also at trace level. The leaked values are live credentials — Microsoft Entra ID bearer tokens, Azure Storage SharedKey signatures, and SAS tokens — and anyone with read access to the logs can replay them until they expire (CWE-532).

Versions 0.22.0 and later, which are the rewritten and currently supported SDK, do not contain the affected code.

Affected versions

Every published legacy version except 0.2.0 writes the authorization header value to logs: 0.1.1 (2022-01-25), and 0.2.1 through 0.21.0 (2024-10-15).

Mitigation

• Upgrade to azure_core 1.0.0 or newer.
• If you are unable to upgrade, raise the log level above debug for the impacted crates or submit a feature request for missing crates built on azure_core 1.0.0 or newer.
• Treat logs produced by an affected build as credential-bearing: rotate any long-lived secret that authenticated a request while debug logging was on.

Coordination

The finding was reported to the Microsoft Security Response Center (VULN-211331), which determined that it does not meet the Microsoft Security Servicing Criteria definition of a security vulnerability.

It was then disclosed publicly as Azure/azure-sdk-for-rust#5074 on 2026-08-15, asking the maintainers to confirm the behavior so that an advisory could be filed for the legacy crates. A maintainer replied on 2026-08-26 and closed the issue as not planned: the legacy branch is unsupported, there are no plans to update it, and users should move to crates built on azure_core 1.0.0 or newer.