Steeltoe.Configuration.Abstractions versions 4.0.0 through 4.1.0 have a vulnerability where TLS client credentials from VCAP_SERVICES bindings for MySQL or PostgreSQL are written to temporary files using File.CreateText in Path.GetTempPath(). On Linux, this results in files with mode 0644 (world-readable) that remain undeleted, exposing sensitive credentials. The same credentials are otherwise protected with mode 0400 in /proc/<pid>/environ. This cleartext storage of sensitive information (CWE-312) combined with improper file permissions (CWE-732) can lead to unauthorized disclosure. The issue is fixed in version 4.2.0. If immediate upgrade is not possible, mitigating by preventing other processes with different UIDs from accessing /tmp in the container is advised.

The vulnerability allows sensitive TLS client credentials to be exposed in world-readable temporary files on Linux systems, potentially enabling unauthorized access to these credentials by other users or processes on the same host. This compromises confidentiality but does not affect integrity or availability. The CVSS score of 4.7 (medium) reflects the local attack vector, high complexity, and low privileges required, with no user interaction needed.

Upgrade Steeltoe.Configuration.Abstractions to version 4.2.0 or later, where the issue is patched. If upgrading immediately is not feasible, restrict access to the container's /tmp directory to prevent other processes running under different UIDs from reading the temporary files containing TLS credentials.