Azure security keyvault certificates: Rejected authentication challenges can poison the Key Vault scope cache
Affects azure_security_keyvault_certificatesSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 1.1.0-beta.2, 1.0.1
Data as of 5 Nov 2026, 09:20 UTC
What to do
Upgrade azure_security_keyvault_certificates to 1.1.0-beta.2 or 1.0.1.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioazure_security_keyvault_certificatespkg:cargo/azure_security_keyvault_certificatesOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Update azure_security_keyvault_certificates to version 1.0.1 on the stable release line or 1.1.0-beta.2 on the preview release line. These versions include a fix that caches the authentication scope only after successful challenge resource verification, preventing rejected challenges from poisoning the cache. No additional mitigation is required if updated. The option to disable challenge resource verification remains unchanged.
Description
A vulnerability in azure_security_keyvault_certificates versions 0.9.0 through 1.0.0 and 1.1.0-beta.1 allows caching of an authentication scope from a rejected challenge, leading to potential bearer token and request body disclosure to attacker-controlled endpoints on subsequent requests using the same client.
References
- crates.io/crates/azure_security_keyvault_certificates (opens in a new tab)
- rustsec.org/advisories/RUSTSEC-2026-0437.html (opens in a new tab)
- github.com/Azure/azure-sdk-for-rust/pull/5121 (opens in a new tab)
- github.com/Azure/azure-sdk-for-rust/pull/5125 (opens in a new tab)
- github.com/Azure/azure-sdk-for-rust/pull/5410 (opens in a new tab)