---
id: RUSTSEC-2026-0438
title: Rejected authentication challenges can poison the Key Vault scope cache
summary: Rejected authentication challenges can poison the Key Vault scope cache
severity: none
vendor: azure_security_keyvault_secrets
product: azure_security_keyvault_secrets
ecosystem: rust
affected:
  - 'azure_security_keyvault_secrets >= 0.10.0, < 1.0.1'
patched:
  - azure_security_keyvault_secrets 1.0.1
published: '2026-08-24'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T09:00:02.642244274Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0438'
references:
  - url: 'https://crates.io/crates/azure_security_keyvault_secrets'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0438.html'
  - url: 'https://github.com/Azure/azure-sdk-for-rust/pull/5121'
  - url: 'https://github.com/Azure/azure-sdk-for-rust/pull/5125'
  - url: 'https://github.com/Azure/azure-sdk-for-rust/pull/5410'
tags:
  - osv
  - rust
ingestedAt: '2026-11-05T15:13:27.896Z'
---

## Overview

Affected versions of `KeyVaultAuthorizer::on_challenge` cache the authentication
scope from a `WWW-Authenticate` response before verifying that the challenge
resource matches the requested endpoint. When verification rejects the challenge,
the scope remains cached. A subsequent request through the same client uses that
scope to authorize the request without repeating challenge resource verification.

For `azure_security_keyvault_secrets`, the affected versions are `0.10.0` through
`1.0.0`, inclusive. Versions before `0.10.0` do not use this challenge-scope cache
and are unaffected by this issue. The published `1.1.0-beta.1` already includes
the fix.

## Impact

An application that sends requests to an attacker-controlled endpoint and reuses
the same client after a rejected challenge can disclose a bearer token and request
body to that endpoint, if its credential can obtain a token for the supplied scope.
The first request's validation error therefore does not prevent disclosure on a
later request. Changing the request origin between requests is not required.

## Fix

Update to `1.0.1` on the stable release line or `1.1.0-beta.1` on the preview
release line.

The fix caches the scope only after challenge resource verification succeeds
when verification is enabled. Rejected challenges no longer populate the cache.
The existing option to disable challenge resource verification is unchanged;
this fix does not add exact-origin binding.

## Affected packages

- `azure_security_keyvault_secrets >= 0.10.0, < 1.0.1`

## Remediation

Upgrade to a patched release:

- `azure_security_keyvault_secrets 1.0.1`