Azure security keyvault keys: Rejected authentication challenges can poison the Key Vault scope cache
Affects azure_security_keyvault_keysSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 1.0.1
Data as of 5 Nov 2026, 09:20 UTC
What to do
Upgrade azure_security_keyvault_keys to 1.0.1.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioazure_security_keyvault_keyspkg:cargo/azure_security_keyvault_keysOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Update azure_security_keyvault_keys to version 1.0.1 or later (stable release) or 1.1.0-beta.1 or later (preview release). The fix ensures that the scope is cached only after successful challenge resource verification, preventing poisoning of the cache by rejected challenges.
Description
A vulnerability in azure_security_keyvault_keys versions 0.10.0 through 1.0.0 allows rejected authentication challenges to poison the Key Vault scope cache. This can lead to bearer token and request body disclosure to an attacker-controlled endpoint if the same client is reused after a rejected challenge. The issue is fixed in version 1.0.1 and later.
References
- crates.io/crates/azure_security_keyvault_keys (opens in a new tab)
- rustsec.org/advisories/RUSTSEC-2026-0439.html (opens in a new tab)
- github.com/Azure/azure-sdk-for-rust/pull/5121 (opens in a new tab)
- github.com/Azure/azure-sdk-for-rust/pull/5125 (opens in a new tab)
- github.com/Azure/azure-sdk-for-rust/pull/5410 (opens in a new tab)