# RUSTSEC-2026-0275: Legacy `azure_core` writes the `authorization` header value to logs > Legacy Azure SDK for Rust leaks authorization headers to logs when debug logging is enabled, allowing attackers with log access to steal credentials. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Not stated - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 15 Aug 2026 ## What is RUSTSEC-2026-0275? RUSTSEC-2026-0275 is a vulnerability in azure_core, published on 15 Aug 2026. ### Official description Applications built on the legacy Azure SDK for Rust (`azure_core` 0.21.0 and earlier) write the value of the outgoing `authorization` header to their logs whenever debug-level logging is enabled, and in every affected version also at trace level. The leaked values are live credentials — Microsoft Entra ID bearer tokens, Azure Storage SharedKey signatures, and SAS tokens — and anyone with read access to the logs can replay them until they expire (CWE-532). Versions 0.22.0 and later, which are the rewritten and currently supported SDK, do not contain the affected code. ## Affected versions Every published legacy version except 0.2.0 writes the `authorization` header value to logs: 0.1.1 (2022-01-25), and 0.2.1 through 0.21.0 (2024-10-15). ## Mitigation - Upgrade to `azure_core` 1.0.0 or newer. - If you are unable to upgrade, raise the log level above debug for the impacted crates or submit a feature request for missing crates built on `azure_core` 1.0.0 or newer. - Treat logs produced by an affected build as credential-bearing: rotate any long-lived secret that authenticated a request while debug logging was on. ## Coordination The finding was reported to the Microsoft Security Response Center (VULN-211331), which determined that it does not meet the Microsoft Security Servicing Criteria definition of a security vulnerability. It was then disclosed publicly as [Azure/azure-sdk-for-rust#5074][issue] on 2026-08-15, asking the maintainers to confirm the behavior so that an advisory could be filed for the legacy crates. A maintainer replied on 2026-08-26 and closed the issue as not planned: the `legacy` branch is unsupported, there are no plans to update it, and users should move to crates built on `azure_core` 1.0.0 or newer. [pr]: https://github.com/Azure/azure-sdk-for-rust/pull/1699 [issue]: https://github.com/Azure/azure-sdk-for-rust/issues/5074 ## Which versions are affected by RUSTSEC-2026-0275? 1 open source package ship an affected version, including azure_core. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `azure_core` | crates.io | From 0.0.0-0 | 0.2.0, 0.22.0 | ## How do I fix RUSTSEC-2026-0275? Upgrade azure_core to a fixed version for your release line: 0.2.0 or 0.22.0. ## Is RUSTSEC-2026-0275 being exploited? There is no known exploitation of RUSTSEC-2026-0275 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for RUSTSEC-2026-0275 and fix it if it is affected. What it is: RUSTSEC-2026-0275 is a vulnerability in azure_core, published on 15 Aug 2026. Exploitation: There is no known exploitation of RUSTSEC-2026-0275 in the wild and no public exploit code. Affected packages and fixed versions: - azure_core (crates.io): affected from 0.0.0-0; fixed in 0.2.0, 0.22.0 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/RUSTSEC-2026-0275/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0275/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/RUSTSEC-2026-0275 --- From sbomify Insights: https://insights.sbomify.com/RUSTSEC-2026-0275/ Summaries are generated and may contain mistakes; the official description above is the record.