CVSS 3.1 base metricsRed raises the risk · green lowers it
Attack vector
LocalAV:L
Attack complexity
HighAC:H
Privileges required
HighPR:H
User interaction
RequiredUI:R
Scope
UnchangedS:U
Confidentiality
HighC:H
Integrity
NoneI:N
Availability
NoneA:N
Updates that fix it
0 KBs
No KB listed
No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.
Affected products
Open Source Software
7 affected products
azl3 kata-containers 4.1.0.kata1-2 on Azure Linux 3.0
azl3 kata-containers 4.1.0.kata2-1 on Azure Linux 3.0
azl3 kata-containers-cc 3.15.0.aks0-23 on Azure Linux 3.0
azl3 kata-containers-cc 3.15.0.aks0-24 on Azure Linux 3.0
azl3 rust 1.75.0-31 on Azure Linux 3.0
azl3 rust 1.98.1-1 on Azure Linux 3.0
azl3 rust-afterburn 5.8.2-2 on Azure Linux 3.0
What changed
Affected products: azl3 kata-containers 4.1.0.kata1-2 on Azure Linux 3.0, azl3 kata-containers-cc 3.15.0.aks0-23 on Azure Linux 3.0, azl3 rust 1.75.0-31 on Azure Linux 3.0, azl3 rust 1.98.1-1 on Azure Linux 3.0, azl3 rust-afterburn 5.8.2-2 on Azure Linux 3.0 → azl3 kata-containers 4.1.0.kata1-2 on Azure Linux 3.0, azl3 kata-containers 4.1.0.kata2-1 on Azure Linux 3.0, azl3 kata-containers-cc 3.15.0.aks0-23 on Azure Linux 3.0, azl3 kata-containers-cc 3.15.0.aks0-24 on Azure Linux 3.0, azl3 rust 1.75.0-31 on Azure Linux 3.0, azl3 rust 1.98.1-1 on Azure Linux 3.0, azl3 rust-afterburn 5.8.2-2 on Azure Linux 3.0
Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
Page history
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
14 Nov 2026 · 08:16:23 UTCAffected productsazl3 kata-containers 4.1.0.kata1-2 on Azure Linux 3.0, azl3 kata-containers-cc 3.15.0.aks0-23 on Azure Linux 3.0, azl3 rust 1.75.0-31 on Azure Linux 3.0, azl3 rust 1.98.1-1 on Azure Linux 3.0, azl3 rust-afterburn 5.8.2-2 on Azure Linux 3.0 → azl3 kata-containers 4.1.0.kata1-2 on Azure Linux 3.0, azl3 kata-containers 4.1.0.kata2-1 on Azure Linux 3.0, azl3 kata-containers-cc 3.15.0.aks0-23 on Azure Linux 3.0, azl3 kata-containers-cc 3.15.0.aks0-24 on Azure Linux 3.0, azl3 rust 1.75.0-31 on Azure Linux 3.0, azl3 rust 1.98.1-1 on Azure Linux 3.0, azl3 rust-afterburn 5.8.2-2 on Azure Linux 3.0
13 Nov 2026 · 12:10:20 UTCPublic detection templateUnknown: detection-template evidence is incomplete or retained → No Nuclei template listed
CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
Which CVEs have scores here?
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
cve-program · CVE-2026-123609
Published
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that …
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Nov 8, 2026, 1:38:34 AM
dateUpdated: Nov 10, 2026, 5:56:51 PM
1 related source bulletins · separate from aliases
msrc_CVE-2026-123609: Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that …
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
### Summary
Formatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store interface already warns that its values are sensitive.
### Details
Derived formatters traverse the session's secret-bearing fields. This conflicts with the project's explicit [key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api).
### Proof of concept
Custom `ClientSessionStore` implementations could leak secret data by using the provided `Tls12ClientSessionValue` or `Tls13ClientSessionValue` in a way that triggers its implementation of the `Debug` trait.
### Impact
Such store implementations could leak the master secret for the TLS connection.
### Acknowledgement
Thanks to OpenAI [[email protected]](mailto:[email protected]) for the disclosure.
Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
`Debug` impls for client session values expose TLS secrets
The `Debug` implementations of `Tls12ClientSessionValue` and
`Tls13ClientSessionValue` were derived, and so included the TLS 1.2 master
secret or TLS 1.3 resumption PSK in their output.
Custom `ClientSessionStore` implementations that format these values with
`Debug` (for example, when logging) could disclose these secrets to readers of
the logs. This conflicts with rustls's
[key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api).
Ordinary connection and built-in session cache `Debug` output is redacted and
is not affected.
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.