Rust advisories / azure_core
Vulnerability MediumRUSTSEC-2026-0275 · azure_core
RUSTSEC-2026-0275: Legacy `azure_core` writes the `authorization` header value to logs
Short answerA security vulnerability in the azure_core crate: Legacy `azure_core` writes the `authorization` header value to logs. Medium severity (CVSS 6.5). Fixed in 0.2.0, 0.22.0: update to a fixed version.
| Crate | azure_core |
|---|---|
| Type | Vulnerability |
| Affected versions | Before 0.2.0; from 0.2.1 before 0.22.0. |
| Fixed in | 0.2.0, 0.22.0 |
| Severity | Medium, CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| Published | 2026-08-15 |
| Last changed | 2026-09-01 |
| Also known as | none |
What to do
- See which version you have:
cargo tree -i azure_core(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p azure_core. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleazure_core = "0.22.0") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Applications built on the legacy Azure SDK for Rust (azure_core 0.21.0 and earlier) write the value of the outgoing authorization header to their logs whenever debug-level logging is enabled, and in every affected version also at trace level. The leaked values are live credentials , Microsoft Entra ID bearer tokens, Azure Storage SharedKey signatures, and SAS tokens , and anyone with read access to the logs can replay them until they expire (CWE-532).
Versions 0.22.0 and later, which are the rewritten and currently supported SDK, do not contain the affected code.
Affected versions
Every published legacy version except 0.2.0 writes the authorization header value to logs: 0.1.1 (2022-01-25), and 0.2.1 through 0.21.0 (2024-10-15).
Mitigation
- Upgrade to
azure_core1.0.0 or newer. - If you are unable to upgrade, raise the log level above debug for the impacted crates or submit a feature request for missing crates built on
azure_core1.0.0 or newer. - Treat logs produced by an affected build as credential-bearing: rotate any long-lived secret that authenticated a request while debug logging was on.
Coordination
The finding was reported to the Microsoft Security Response Center (VULN-211331), which determined that it does not meet the Microsoft Security Servicing Criteria definition of a security vulnerability.
It was then disclosed publicly as Azure/azure-sdk-for-rust#5074 on 2026-08-15, asking the maintainers to confirm the behavior so that an advisory could be filed for the legacy crates. A maintainer replied on 2026-08-26 and closed the issue as not planned: the legacy branch is unsupported, there are no plans to update it, and users should move to crates built on azure_core 1.0.0 or newer.
References
- Package: crates.io/crates/azure_core
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0275.html
- Report: github.com/Azure/azure-sdk-for-rust/issues/5074
- Web: github.com/Azure/azure-sdk-for-rust/pull/1699
- Web: github.com/Azure/azure-sdk-for-rust/commit/7a0e20c1e002ce06da0f3ec8795ef1529862ea97
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?