Azure security keyvault secrets: Rejected authentication challenges can poison the Key Vault scope cache
Affects azure_security_keyvault_secretsSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 1.0.1
Data as of 5 Nov 2026, 09:20 UTC
What to do
Upgrade azure_security_keyvault_secrets to 1.0.1.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioazure_security_keyvault_secretspkg:cargo/azure_security_keyvault_secretsOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Update azure_security_keyvault_secrets to version 1.0.1 or later (stable release) or 1.1.0-beta.1 or later (preview release). The fix prevents caching of scopes from rejected challenges by caching only after successful challenge resource verification. No additional action is required if already updated. The option to disable challenge resource verification remains unchanged.
Description
A vulnerability in azure_security_keyvault_secrets versions 0.10.0 through 1.0.0 allows rejected authentication challenges to poison the Key Vault scope cache. This can cause subsequent requests to reuse a cached scope without proper verification, potentially disclosing bearer tokens and request bodies to attacker-controlled endpoints. The issue is fixed in version 1.0.1 and later.
References
- crates.io/crates/azure_security_keyvault_secrets (opens in a new tab)
- rustsec.org/advisories/RUSTSEC-2026-0438.html (opens in a new tab)
- github.com/Azure/azure-sdk-for-rust/pull/5121 (opens in a new tab)
- github.com/Azure/azure-sdk-for-rust/pull/5125 (opens in a new tab)
- github.com/Azure/azure-sdk-for-rust/pull/5410 (opens in a new tab)