{"action":"Upgrade Steeltoe.Configuration.Abstractions to 4.2.0 or later.","affected":[{"fixed":"4.2.0","introduced":"4.0.0"}],"component":"Steeltoe.Configuration.Abstractions","cve_ids":["CVE-2026-50267"],"ecosystem":"NuGet","epss":0.00065,"exploited":false,"fixed_versions":["4.2.0"],"ghsa_id":"GHSA-rxrh-4j9h-xgg9","id":"tcs_01M5N90VFN141S0VCTF50H47S1","modified_at":"2026-07-02T20:56:33.690158Z","published_at":"2026-07-02T20:32:09Z","references":["https://osv.dev/vulnerability/GHSA-rxrh-4j9h-xgg9","https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-rxrh-4j9h-xgg9","https://nvd.nist.gov/vuln/detail/CVE-2026-50267","https://github.com/SteeltoeOSS/Steeltoe/commit/8dd97cc6c4b184121a4bd1f92f9ac16918433471","https://github.com/SteeltoeOSS/security-advisories"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-rxrh-4j9h-xgg9","url":"https://osv.dev/vulnerability/GHSA-rxrh-4j9h-xgg9"}],"summary":"Steeltoe: TLS private keys written to /tmp with default permissions, never deleted"}