{"answers":{"affected":"1 open source package ship an affected version, including azure_core.","exploited":"There is no known exploitation of RUSTSEC-2026-0275 in the wild and no public exploit code.","fix":"Upgrade azure_core to a fixed version for your release line: 0.2.0 or 0.22.0.","what":"RUSTSEC-2026-0275 is a vulnerability in azure_core, published on 15 Aug 2026."},"fix_prompt":"Check this codebase for RUSTSEC-2026-0275 and fix it if it is affected.\n\nWhat it is: RUSTSEC-2026-0275 is a vulnerability in azure_core, published on 15 Aug 2026. \nExploitation: There is no known exploitation of RUSTSEC-2026-0275 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- azure_core (crates.io): affected from 0.0.0-0; fixed in 0.2.0, 0.22.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/RUSTSEC-2026-0275/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0275/index.md)","id":"RUSTSEC-2026-0275","markdown":"https://insights.sbomify.com/RUSTSEC-2026-0275/index.md","name":"RUSTSEC-2026-0275","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","account_takeover"],"network_reachable":"unknown","non_default_config":true,"product_category":"Azure SDK for Rust","requires_auth":"none","summary":"Legacy Azure SDK for Rust leaks authorization headers to logs when debug logging is enabled, allowing attackers with log access to steal credentials.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Applications built on the legacy Azure SDK for Rust (`azure_core` 0.21.0 and\nearlier) write the value of the outgoing `authorization` header to their logs\nwhenever debug-level logging is enabled, and in every affected version also at\ntrace level. The leaked values are live credentials — Microsoft Entra\nID bearer tokens, Azure Storage SharedKey signatures, and SAS tokens — and\nanyone with read access to the logs can replay them until they expire\n(CWE-532).\n\nVersions 0.22.0 and later, which are the rewritten and currently supported\nSDK, do not contain the affected code.\n\n## Affected versions\n\nEvery published legacy version except 0.2.0 writes the `authorization` header\nvalue to logs: 0.1.1 (2022-01-25), and 0.2.1 through 0.21.0 (2024-10-15).\n\n## Mitigation\n\n- Upgrade to `azure_core` 1.0.0 or newer.\n- If you are unable to upgrade, raise the log level above debug for the\n  impacted crates or submit a feature request for missing crates built on `azure_core` 1.0.0 or newer.\n- Treat logs produced by an affected build as credential-bearing: rotate any\n  long-lived secret that authenticated a request while debug logging was on.\n\n## Coordination\n\nThe finding was reported to the Microsoft Security Response Center\n(VULN-211331), which determined that it does not meet the Microsoft Security\nServicing Criteria definition of a security vulnerability.\n\nIt was then disclosed publicly as [Azure/azure-sdk-for-rust#5074][issue] on\n2026-08-15, asking the maintainers to confirm the behavior so that an advisory\ncould be filed for the legacy crates. A maintainer replied on 2026-08-26 and\nclosed the issue as not planned: the `legacy` branch is unsupported, there are\nno plans to update it, and users should move to crates built on `azure_core`\n1.0.0 or newer.\n\n[pr]: https://github.com/Azure/azure-sdk-for-rust/pull/1699\n[issue]: https://github.com/Azure/azure-sdk-for-rust/issues/5074","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Legacy `azure_core` writes the `authorization` header value to logs","id":"RUSTSEC-2026-0275","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.2.0","0.22.0"],"introduced":["0.0.0-0","0.2.1-0"],"last_affected":[],"package":"azure_core","purl":"pkg:cargo/azure_core","source":"RUSTSEC-2026-0275"}],"products":null,"published":"2026-08-15","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Legacy Azure SDK for Rust leaks authorization headers to logs when debug logging is enabled, allowing attackers with log access to steal credentials.","url":"https://insights.sbomify.com/RUSTSEC-2026-0275/"}