Applications built on the legacy Azure SDK for Rust (azure core 0.21.0 and earlier) write the value of the outgoing authorization header to their logs whenever debug-level logging is enabled, and in every affected version also at trace level. The leaked values are live credentials — Microsoft Entra ID bearer tokens, Azure Storage SharedKey signatures, and SAS tokens — and anyone with read access to the logs can replay them until they expire (CWE-532).

Versions 0.22.0 and later, which are the rewritten and currently supported SDK, do not contain the affected code.

Every published legacy version except 0.2.0 writes the authorization header value to logs: 0.1.1 (2022-01-25), and 0.2.1 through 0.21.0 (2024-10-15).

The finding was reported to the Microsoft Security Response Center (VULN-211331), which determined that it does not meet the Microsoft Security Servicing Criteria definition of a security vulnerability.

It was then disclosed publicly as Azure/azure-sdk-for-rust#5074 on 2026-08-15, asking the maintainers to confirm the behavior so that an advisory could be filed for the legacy crates. A maintainer replied on 2026-08-26 and closed the issue as not planned: the legacy branch is unsupported, there are no plans to update it, and users should move to crates built on azure core 1.0.0 or newer.