PatchSiren cyber security CVE debrief
CVE-2026-50268 SteeltoeOSS CVE debrief
A low-severity vulnerability was found in Steeltoe.Configuration.Encryption versions 4.0.0 through 4.1.0. The issue arises when configuring `encrypt:rsa:algorithm=OAEP`, which does not enable OAEP encryption due to an incorrect BouncyCastle transformation string. Instead, it selects PKCS#1 v1.5, the same algorithm as the `DEFAULT` setting. This vulnerability has a CVSS score of 1.9 and is considered low severity. The issue was patched in Steeltoe.Configuration.Encryption version 4.2.0. Users of affected versions should update to the latest version to ensure proper encryption.
- Vendor
- SteeltoeOSS
- Product
- Steeltoe.Configuration.Encryption
- CVSS
- LOW 1.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-17
- Original CVE updated
- 2026-06-22
- Advisory published
- 2026-06-17
- Advisory updated
- 2026-06-22
Who should care
Developers and administrators using Steeltoe.Configuration.Encryption versions 4.0.0 through 4.1.0 should be aware of this vulnerability. Although the CVSS score is low, it is essential to update to version 4.2.0 or later to ensure proper encryption and mitigate potential risks.
Technical summary
The vulnerability in Steeltoe.Configuration.Encryption versions 4.0.0 through 4.1.0 is caused by an incorrect BouncyCastle transformation string when configuring `encrypt:rsa:algorithm=OAEP`. This results in the selection of PKCS#1 v1.5 instead of OAEP, which is the same algorithm as the `DEFAULT` setting. The issue was introduced due to an incorrect transformation string. The CVSS vector for this vulnerability is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N.
Defensive priority
Low
Recommended defensive actions
- Update Steeltoe.Configuration.Encryption to version 4.2.0 or later
- Review and verify encryption configurations for OAEP
- Ensure proper encryption is enabled in Steeltoe applications
- Monitor for potential security risks associated with weak encryption
- Consider implementing additional security measures for sensitive data
- Regularly review and update dependencies to prevent similar vulnerabilities
Evidence notes
The information provided is based on the CVE record and NVD details. The vulnerability was published on June 17, 2026, and modified on June 18, 2026. The CVSS score is 1.9, indicating low severity. References to the vulnerability can be found on GitHub and the NVD website.
Official resources
public