CVE-2026-50267

Name of the Vulnerable Software and Affected Versions Steeltoe.Configuration.Abstractions versions 4.0.0 through 4.1.0

Description When MySQL or PostgreSQL service bindings from VCAP SERVICES include TLS client credentials, the Connectors library writes these credentials to temporary files in Path.GetTempPath() using the File.CreateText() function. On Linux systems, File.CreateText() creates files with mode 0644 (world-readable) under the process umask, and these files are never deleted. This exposes key material that is otherwise protected at mode 0400 in /proc/<pid>/environ.

Recommendations Update to version 4.2.0. As a temporary workaround, prevent other processes from running in the container under a different UID with access to /tmp.