CVE-2026-50268 Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
Misconfigured OAEP setting silently uses weaker PKCS#1 v1.5 padding, reducing encryption security in Steeltoe applications.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50268?
CVE-2026-50268 is a low-severity vulnerability in SteeltoeOSS Steeltoe.Configuration.Encryption, published on 17 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encryption 4.0.0 through 4.1.0, configuring `encrypt:rsa:algorithm=OAEP` does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the `OAEP` setting selects PKCS#1 v1.5, which is the same algorithm as the `DEFAULT` setting. Steeltoe.Configuration.Encryption version 4.2.0 patches the issue.
Which versions are affected by CVE-2026-50268?
2 open source packages ship an affected version, including Steeltoe.Configuration.Encryption.
| Package | Affected | Fixed in |
|---|---|---|
Steeltoe.Configuration.Encryption NuGet | From 4.0.0 | 4.2.0 |
Steeltoe.Configuration.Encryption NuGet | From 4.0.0 | 4.2.0 |
How do I fix CVE-2026-50268?
Upgrade Steeltoe.Configuration.Encryption to 4.2.0 or later.
Is CVE-2026-50268 being exploited?
There is no known exploitation of CVE-2026-50268 in the wild and no public exploit code.
Sources
Also known as GHSA-4j9m-h44m-2hv8.