CVE-2024-40636 is a vulnerability in Steeltoe's Eureka Discovery Client that can lead to credential exposure. Specifically, when the application fails to fetch the service registry using multiple Eureka server URLs with basic authentication, it logs an error message containing the unmasked credentials of the subsequent URLs after the first one. This credential leak occurs because only the first URL is masked, potentially exposing sensitive information in the application logs. With an SVRS score of 30, this vulnerability is not considered critical but should still be addressed to prevent unauthorized access. This issue can compromise the security of your cloud-native applications by allowing attackers to potentially obtain credentials from log files. Upgrade to Steeltoe.Discovery.Eureka version 3.2.8 or later to mitigate this risk. While the CVSS score is 0 the real-world implications make patching essential.