CVE-2026-50267: Steeltoe Exposes Database TLS Credentials in World-Readable Temp Files on Linux

Technical summary

In Steeltoe.Configuration.Abstractions 4.0.0–4.1.0, the Connectors library processes VCAP_SERVICES environment variables containing MySQL and PostgreSQL service bindings with TLS credentials. It calls File.CreateText() to write these credentials to the system temp directory (via Path.GetTempPath()). On Linux, File.CreateText() respects the process umask and creates files with default permissions (0644), rendering them world-readable. The files persist indefinitely in /tmp or /var/tmp until manual deletion or container termination. This contrasts with the restrictive mode (0400) applied to the same credentials in /proc/<pid>/environ, indicating the temp file permissions are unintentional. The underlying issue stems from CWE-312 (Cleartext Storage of Sensitive Information) and CWE-732 (Incorrect Permission Assignment for Critical Resource).

Business impact

Container workloads using Steeltoe to connect to MySQL or PostgreSQL risk credential exposure to co-tenant processes, particularly in shared multi-tenant Kubernetes clusters or other container orchestration environments. An attacker with local process execution capability in the same container or namespace can harvest TLS certificates and private keys, then impersonate the application to the database or decrypt encrypted traffic. This enables unauthorized data access, modification, or exfiltration without requiring network-level compromise. For applications processing sensitive data (PII, financial records), the blast radius extends to downstream compliance violations and data breach liability.

Affected systems

Applications using Steeltoe.Configuration.Abstractions library versions 4.0.0 through 4.1.0 in cloud environments (particularly Cloud Foundry or Kubernetes) that rely on VCAP_SERVICES or similar environment-based service bindings for MySQL or PostgreSQL connections with TLS are affected. Applications using Steeltoe versions prior to 4.0.0 or version 4.2.0 and later are not vulnerable. The vulnerability manifests only on Linux; Windows deployments are not affected due to different file permission semantics.

Exploitability

Exploitation requires local process-level access on the affected container or system—the attacker cannot exploit this remotely. However, the barrier to exploitation within a container is low: any process running under a different UID than the application, or any unprivileged user with shell access to the container, can read the temp files. The CVSS 3.1 score of 4.7 (MEDIUM, AV:L/AC:H/PR:L/UI:N) reflects this—local access with low privileges is needed, but once obtained, exploitation is straightforward. The 'high' confidentiality impact (C:H) reflects full exposure of TLS credentials. Exploitation does not require user interaction and there is no attack complexity beyond gaining local shell access.

Remediation

Upgrade Steeltoe.Configuration.Abstractions to version 4.2.0 or later at your earliest convenience. Verify the patched version is available from NuGet and that your dependency resolution pulls the correct package version. If an immediate upgrade is not feasible, implement compensating controls: restrict container execution to a single UID, enforce read-only root filesystems or restrict /tmp permissions, use Pod Security Policies or network policies to prevent process injection, and monitor /tmp for suspicious file creation. However, these mitigations are incomplete and should not delay patching.

Patch guidance

Steeltoe.Configuration.Abstractions 4.2.0 is the first patched version. Update your project's NuGet package reference to 4.2.0 or higher. After patching, redeploy affected container images and restart running instances. There are no known breaking changes in 4.2.0, so the upgrade should be drop-in compatible. Verify that TLS credentials are no longer written to /tmp by examining temp directory contents during application startup, or by enabling verbose logging in Steeltoe if available. For projects managed via central dependency management (e.g., global.json or Directory.Packages.props), ensure the Steeltoe version constraint is updated centrally to prevent accidental downgrades.

Detection guidance

Proactive detection: scan running containers or systems for world-readable files in /tmp matching patterns of certificate or key material (e.g., *.crt, *.key, *.pem). Monitor container image build and runtime logs for Steeltoe version references (grep NuGet package manifests or build output). In Kubernetes, enable Pod Security Policies or Pod Security Standards to restrict /tmp permissions and alert on attempts to access other pods' /tmp mounts. Reactive detection: search application logs or container runtime logs for File.CreateText() calls or Steeltoe Configuration Connectors initialization messages. Query package managers or software composition analysis (SCA) tools for Steeltoe version inventories. Intrusion detection systems can flag processes reading files from /tmp with TLS certificate extensions while running under different UIDs.

Why prioritize this

While the CVSS score is MEDIUM (4.7), the vulnerability warrants elevated priority in container-heavy environments. The exposure of database credentials to local processes creates a critical supply-chain risk: an attacker in a shared container or adjacent pod can pivot to the database and exfiltrate or corrupt data. The lack of explicit cleanup means credentials persist indefinitely, multiplying the window of exposure. For financial services, healthcare, or any regulated sector handling sensitive data, the compliance implications (data breach notification, audit findings) accelerate remediation urgency. Conversely, air-gapped or single-tenant deployments may tolerate lower urgency if they lack multi-process or multi-tenant threat models.

Risk score, explained

CVSS 3.1 score 4.7 derives from: Attack Vector Local (AV:L) — requires local shell or process execution on the container; Attack Complexity High (AC:H) — the attacker must navigate container isolation and locate the temp files; Privileges Required Low (PR:L) — any unprivileged user or different UID suffices; User Interaction None (UI:N) — no user action needed; Scope Unchanged (S:U) — impact is confined to the affected system; Confidentiality High (C:H) — full disclosure of TLS keys and certificates; Integrity None (I:N) — credentials are not modified, only read; Availability None (A:N) — no denial-of-service impact. The score reflects realistic local exploitation within a container threat model. Business context (regulated data, multi-tenant infrastructure) may warrant risk elevation beyond the base CVSS.

Frequently asked questions