CVE-2026-50268 Details
Description
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encryption 4.0.0 through 4.1.0, configuring `encrypt:rsa:algorithm=OAEP` does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the `OAEP` setting selects PKCS#1 v1.5, which is the same algorithm as the `DEFAULT` setting. Steeltoe.Configuration.Encryption version 4.2.0 patches the issue.
A vulnerability exists in Steeltoe.Configuration.Encryption versions 4.0.0 through 4.1.0, where the 'encrypt:rsa:algorithm=OAEP' configuration does not enable true OAEP encryption. Instead, it defaults to PKCS#1 v1.5 padding, the same as the 'DEFAULT' setting. This misconfiguration arises from an incorrect transformation string used by BouncyCastle. While the issue currently does not expose an exploitable decryption oracle, any future code path that does could lead to vulnerabilities under the Bleichenbacher attack, especially since the 'Decrypt()' method is applied to operator-controlled configuration data.
Upgrade to Steeltoe.Configuration.Encryption version 4.2.0. After upgrading, re-encrypt any affected '{cipher}' values, as the fixed version uses proper OAEP padding, which is incompatible with values encrypted under the previous misconfiguration.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 17, 2026CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-4j9m-h44m-2hv8 | [email protected] | AdvisoryRemedyVendor |
| https://github.com/SteeltoeOSS/Steeltoe/commit/6cfee5cccddf8f9a31de69b0ca5ccdd771b73e5b | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-256 | Plaintext Storage of a Password | [email protected] |
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Steeltoe.Configuration.Encryption | >= 4.0.0, <= 4.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |