{"id":"RUSTSEC-2026-0438","summary":"Rejected authentication challenges can poison the Key Vault scope cache","details":"Affected versions of `KeyVaultAuthorizer::on_challenge` cache the authentication\nscope from a `WWW-Authenticate` response before verifying that the challenge\nresource matches the requested endpoint. When verification rejects the challenge,\nthe scope remains cached. A subsequent request through the same client uses that\nscope to authorize the request without repeating challenge resource verification.\n\nFor `azure_security_keyvault_secrets`, the affected versions are `0.10.0` through\n`1.0.0`, inclusive. Versions before `0.10.0` do not use this challenge-scope cache\nand are unaffected by this issue. The published `1.1.0-beta.1` already includes\nthe fix.\n\n## Impact\n\nAn application that sends requests to an attacker-controlled endpoint and reuses\nthe same client after a rejected challenge can disclose a bearer token and request\nbody to that endpoint, if its credential can obtain a token for the supplied scope.\nThe first request's validation error therefore does not prevent disclosure on a\nlater request. Changing the request origin between requests is not required.\n\n## Fix\n\nUpdate to `1.0.1` on the stable release line or `1.1.0-beta.1` on the preview\nrelease line.\n\nThe fix caches the scope only after challenge resource verification succeeds\nwhen verification is enabled. Rejected challenges no longer populate the cache.\nThe existing option to disable challenge resource verification is unchanged;\nthis fix does not add exact-origin binding.","modified":"2026-11-05T09:00:02.642244274Z","published":"2026-08-24T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/azure_security_keyvault_secrets"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0438.html"},{"type":"WEB","url":"https://github.com/Azure/azure-sdk-for-rust/pull/5121"},{"type":"WEB","url":"https://github.com/Azure/azure-sdk-for-rust/pull/5125"},{"type":"WEB","url":"https://github.com/Azure/azure-sdk-for-rust/pull/5410"}],"affected":[{"package":{"name":"azure_security_keyvault_secrets","ecosystem":"crates.io","purl":"pkg:cargo/azure_security_keyvault_secrets"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.0"},{"fixed":"1.0.1"}]}],"ecosystem_specific":{"affects":{"functions":[],"arch":[],"os":[]},"affected_functions":null},"database_specific":{"informational":null,"categories":[],"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0438.json","cvss":null}}],"schema_version":"1.9.2"}