CVE-2024-40636
Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness
Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. The code in question is _logger.LogError(e, "FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString()); in the DiscoveryClient.cs file which may leak credentials into logs. This issue has been addressed in version 3.2.8 of the Steeltoe.Discovery.Eureka nuget package.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness
Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. The code in question is _logger.LogError(e, "FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString()); in the DiscoveryClient.cs file which may leak credentials into logs. This issue has been addressed in version 3.2.8 of the Steeltoe.Discovery.Eureka nuget package.
- Record
CVE-2024-40636- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
EUVDEUVD-2024-2425
Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. The code in question is _logger.LogError(e, "FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString()); in the DiscoveryClient.cs file which may leak credentials into logs. This issue has been addressed in version 3.2.8 of the Steeltoe.Discovery.Eureka nuget package.
- Record
EUVD-2024-2425- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vmcp-66r5-3pcp
Steeltoe Leaks Basic Auth Credentials to Logs After Fetch Registry Error
Summary
When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked.
Details
Package: Steeltoe.Discovery.Eureka
Package version: 3.2.1
Branch: "release/3.2"
File name: DiscoveryClient.cs
Line number: 325
Code in question: _logger.LogError(e, "FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());
Error message in logs: FetchRegistry Failed for Eureka service urls: https://****:****@eureka1.com:443/eureka,https://user:[email protected]:443/eureka
I thought new Uri(clientOptions.EurekaServerServiceUrls) would throw a UriFormatException since there are multiple URLs but my logs are showing two URLs regardless.
PoC
- Set Eureka config with multiple server URLs with basic auth
- Apologies for not being more descriptive for this step, but I believe we would just need to trigger an exception in
FetchFullRegistryAsync. - Check the logs and should see the error
Impact
Vulnerability: Credential leakage in the logs Who does it impact?: Users who are using peer awareness with Spring Eureka
- Record
GHSA-vmcp-66r5-3pcp- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 2.5 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
NVD
Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. The code in question is _logger.LogError(e, "FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString()); in the DiscoveryClient.cs file which may leak credentials into logs. This issue has been addressed in version 3.2.8 of the Steeltoe.Discovery.Eureka nuget package.
- Record
CVE-2024-40636- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVGHSA-vmcp-66r5-3pcp
Steeltoe Leaks Basic Auth Credentials to Logs After Fetch Registry Error
Summary
When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked.
Details
Package: Steeltoe.Discovery.Eureka
Package version: 3.2.1
Branch: "release/3.2"
File name: DiscoveryClient.cs
Line number: 325
Code in question: _logger.LogError(e, "FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());
Error message in logs: FetchRegistry Failed for Eureka service urls: https://****:****@eureka1.com:443/eureka,https://user:[email protected]:443/eureka
I thought new Uri(clientOptions.EurekaServerServiceUrls) would throw a UriFormatException since there are multiple URLs but my logs are showing two URLs regardless.
PoC
- Set Eureka config with multiple server URLs with basic auth
- Apologies for not being more descriptive for this step, but I believe we would just need to trigger an exception in
FetchFullRegistryAsync. - Check the logs and should see the error
Impact
Vulnerability: Credential leakage in the logs Who does it impact?: Users who are using peer awareness with Spring Eureka
- Record
GHSA-vmcp-66r5-3pcp- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 2.5 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Steeltoe.Discovery.EurekaNuGet |
through 3.2.7 | 3.2.8 |
Steeltoe.Discovery.EurekaBaseNuGet |
through 2.5.5 | None known |
Steeltoe.Discovery.ClientCoreNuGet |
before 3.0.0 | 3.0.0 |
Steeltoe.Discovery.ClientAutofacNuGet |
through 2.5.5 | None known |
Steeltoe.Discovery.EurekaNuGet |
before 3.2.8, plus listed versions 3.0.03.0.0-rc13.0.13.0.23.1.0 Show 14 moreShow less3.1.0-rc13.1.0-rc23.1.13.1.23.1.33.2.03.2.0-rc13.2.13.2.23.2.33.2.43.2.53.2.63.2.7 |
3.2.8 |
Steeltoe.Discovery.EurekaBaseNuGet |
through 2.5.5, plus listed versions 2.0.02.0.12.1.02.1.0-rc12.1.1 Show 17 moreShow less2.2.02.2.0-rc12.2.0-rc22.3.02.3.0-rc12.3.0-rc22.4.02.4.0-rc12.4.12.4.22.4.32.4.42.5.02.5.12.5.22.5.32.5.4 |
None known |
Steeltoe.Discovery.ClientCoreNuGet |
All versions, plus listed versions 2.0.02.0.0-rc12.0.12.1.02.1.0-rc1 Show 45 moreShow less2.1.12.2.02.2.0-rc12.2.0-rc22.3.02.3.0-rc12.3.0-rc22.4.02.4.0-rc12.4.12.4.22.4.32.4.42.5.02.5.12.5.22.5.32.5.42.5.53.0.03.0.0-m13.0.0-m23.0.0-m33.0.0-rc13.0.13.0.23.1.03.1.0-rc13.1.0-rc23.1.13.1.23.1.33.2.03.2.0-rc13.2.13.2.23.2.33.2.43.2.53.2.63.2.73.2.83.3.03.4.04.0.0 |
None known |
Steeltoe.Discovery.ClientAutofacNuGet |
through 2.5.5, plus listed versions 2.0.02.0.0-rc12.0.12.1.02.1.0-rc1 Show 18 moreShow less2.1.12.2.02.2.0-rc12.2.0-rc22.3.02.3.0-rc12.3.0-rc22.4.02.4.0-rc12.4.12.4.22.4.32.4.42.5.02.5.12.5.22.5.32.5.4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-40636 is a medium vulnerability (CVSS 5.3) in Steeltoeoss Discovery, published July 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in Steeltoe.Discovery.Eureka 3.2.8.