{"id":"CVE-2024-40636","aliases":["EUVD-2024-2425","GHSA-vmcp-66r5-3pcp"],"status":"published","title":"Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness","description":"Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. The code in question is  `_logger.LogError(e, \"FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}\", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());` in the `DiscoveryClient.cs` file which may leak credentials into logs. This issue has been addressed in version 3.2.8 of the Steeltoe.Discovery.Eureka nuget package.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00418,"percentile":0.36406,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2024-07-17T16:00:10Z","modified":"2026-09-10T03:50:17Z","fixes":[{"ecosystem":"NuGet","package":"Steeltoe.Discovery.Eureka","fixed_in":["3.2.8"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Steeltoe.Discovery.ClientCore","fixed_in":["3.0.0"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Steeltoe.Discovery.Eureka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.2.7"},{"fixed":"3.2.8"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Steeltoe.Discovery.EurekaBase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.5.5"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Steeltoe.Discovery.ClientCore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Steeltoe.Discovery.ClientAutofac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.5.5"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Steeltoe.Discovery.Eureka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8"}]}],"versions":["3.0.0","3.0.0-rc1","3.0.1","3.0.2","3.1.0","3.1.0-rc1","3.1.0-rc2","3.1.1","3.1.2","3.1.3","3.2.0","3.2.0-rc1","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7"]},{"source":"osv","ecosystem":"NuGet","package":"Steeltoe.Discovery.EurekaBase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.5.5"}]}],"versions":["2.0.0","2.0.1","2.1.0","2.1.0-rc1","2.1.1","2.2.0","2.2.0-rc1","2.2.0-rc2","2.3.0","2.3.0-rc1","2.3.0-rc2","2.4.0","2.4.0-rc1","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5"]},{"source":"osv","ecosystem":"NuGet","package":"Steeltoe.Discovery.ClientCore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0","2.0.0-rc1","2.0.1","2.1.0","2.1.0-rc1","2.1.1","2.2.0","2.2.0-rc1","2.2.0-rc2","2.3.0","2.3.0-rc1","2.3.0-rc2","2.4.0","2.4.0-rc1","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","3.0.0","3.0.0-m1","3.0.0-m2","3.0.0-m3","3.0.0-rc1","3.0.1","3.0.2","3.1.0","3.1.0-rc1","3.1.0-rc2","3.1.1","3.1.2","3.1.3","3.2.0","3.2.0-rc1","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.3.0","3.4.0","4.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"Steeltoe.Discovery.ClientAutofac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.5.5"}]}],"versions":["2.0.0","2.0.0-rc1","2.0.1","2.1.0","2.1.0-rc1","2.1.1","2.2.0","2.2.0-rc1","2.2.0-rc2","2.3.0","2.3.0-rc1","2.3.0-rc2","2.4.0","2.4.0-rc1","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5"]}],"products":[{"vendor":"kiteworks","product":"security-advisories"},{"vendor":"steeltoeoss","product":"discovery"},{"vendor":"steeltoeoss","product":"security-advisories"}],"references":[{"url":"https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-vmcp-66r5-3pcp","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/SteeltoeOSS/Steeltoe/commit/c5d4a94e90ccb77f8e851bc681a2e348a95e7ecb","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40636","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vmcp-66r5-3pcp"},{"url":"https://github.com/SteeltoeOSS/security-advisories","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-40636","title":"Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness","description":"Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. The code in question is  `_logger.LogError(e, \"FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}\", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());` in the `DiscoveryClient.cs` file which may leak credentials into logs. This issue has been addressed in version 3.2.8 of the Steeltoe.Discovery.Eureka nuget package.","status":"published","published":"2024-07-17T17:48:26.029Z","modified":"2024-08-02T04:33:11.743Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:34:07.152829Z"}],"euvd":[{"id":"EUVD-2024-2425","description":"Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. The code in question is  `_logger.LogError(e, \"FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}\", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());` in the `DiscoveryClient.cs` file which may leak credentials into logs. This issue has been addressed in version 3.2.8 of the Steeltoe.Discovery.Eureka nuget package.","status":"published","published":"2024-07-17T17:48:26Z","modified":"2024-08-02T04:33:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:17.469599Z"}],"ghsa":[{"id":"GHSA-vmcp-66r5-3pcp","title":"Steeltoe Leaks Basic Auth Credentials to Logs After Fetch Registry Error","description":"### Summary\nWhen utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked.\n\n### Details\nPackage: Steeltoe.Discovery.Eureka\nPackage version: 3.2.1\nBranch: \"release/3.2\"\nFile name: `DiscoveryClient.cs`\nLine number: 325\nCode in question:  `_logger.LogError(e, \"FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}\", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());`\n\n\nError message in logs: `FetchRegistry Failed for Eureka service urls: https://****:****@eureka1.com:443/eureka,https://user:password@eureka2.com:443/eureka`\n\nI thought `new Uri(clientOptions.EurekaServerServiceUrls)` would throw a `UriFormatException` since there are multiple URLs but my logs are showing two URLs regardless.\n\n### PoC\n1. Set Eureka config with multiple server URLs with basic auth\n2. Apologies for not being more descriptive for this step, but I believe we would just need to trigger an exception in `FetchFullRegistryAsync`.\n3. Check the logs and should see the error \n\n### Impact\nVulnerability: Credential leakage in the logs\nWho does it impact?: Users who are using peer awareness with Spring Eureka","status":"published","published":"2024-07-17T16:00:10Z","modified":"2024-08-06T05:04:05Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"},{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:37:57.422393Z"}],"nvd":[{"id":"CVE-2024-40636","description":"Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. The code in question is  `_logger.LogError(e, \"FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}\", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());` in the `DiscoveryClient.cs` file which may leak credentials into logs. This issue has been addressed in version 3.2.8 of the Steeltoe.Discovery.Eureka nuget package.","status":"published","published":"2024-07-17T18:15:04.343Z","modified":"2026-06-17T07:46:12.95Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:10:13.413515Z"}],"osv":[{"id":"GHSA-vmcp-66r5-3pcp","title":"Steeltoe Leaks Basic Auth Credentials to Logs After Fetch Registry Error","description":"### Summary\nWhen utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked.\n\n### Details\nPackage: Steeltoe.Discovery.Eureka\nPackage version: 3.2.1\nBranch: \"release/3.2\"\nFile name: `DiscoveryClient.cs`\nLine number: 325\nCode in question:  `_logger.LogError(e, \"FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}\", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());`\n\n\nError message in logs: `FetchRegistry Failed for Eureka service urls: https://****:****@eureka1.com:443/eureka,https://user:password@eureka2.com:443/eureka`\n\nI thought `new Uri(clientOptions.EurekaServerServiceUrls)` would throw a `UriFormatException` since there are multiple URLs but my logs are showing two URLs regardless.\n\n### PoC\n1. Set Eureka config with multiple server URLs with basic auth\n2. Apologies for not being more descriptive for this step, but I believe we would just need to trigger an exception in `FetchFullRegistryAsync`.\n3. Check the logs and should see the error \n\n### Impact\nVulnerability: Credential leakage in the logs\nWho does it impact?: Users who are using peer awareness with Spring Eureka","status":"published","published":"2024-07-17T16:00:10Z","modified":"2026-09-10T03:50:17.534390938Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:57.348035Z"}]}}