Audience: Microservice Developers and Tenant Administrators
Applies to: Cumulocity SaaS and Self-Hosted
Overview
As part of an internal security review, we identified that some customer-hosted microservices are built using older versions of the Cumulocity Microservice SDK that have not been updated for several years. We also observed that credentials stored in the corresponding tenant configurations have, in some cases, remained unchanged for extended periods.
Cumulocity supports that customer microservices remain deployed and operational for long periods without requiring changes. As a result, their underlying SDK versions, configurations, and credentials may not always receive periodic security updates.
Cumulocity provides Encrypted Tenant Options to securely store sensitive configuration used by microservices, such as API keys, access tokens, passwords, private keys, and other authentication information. While encrypted tenant options provide protection for sensitive information at rest, they do not replace the need for keeping microservices up to date or managing the lifecycle of credentials through appropriate review and rotation.
This advisory is therefore issued in the interest of our customers as a preventive security measure. We recommend customers to review their existing microservices, the SDK versions they are built with, the tenant options they consume, and any credentials stored within those options.
Recommended Actions
For Tenant Administrators
-
Track Expiry Externally: Maintain an external calendar or secret-management registry to track credentials (used in tenant options) age and expiry. Note that Cumulocity does not alert you when these credentials become old or are due for rotation.
-
Audit & Rotate: Maintain an inventory of all sensitive tenant options used and rotate them as per your security policies.
-
Verify: After updating credentials, confirm that the associated microservices continue to operate correctly and can successfully authenticate with the external services.
-
Remove Unused Credentials: Review older microservices and configurations and remove credentials, tenant options, or microservices that are no longer required.
For Microservice Developers
-
Update SDKs: Keep microservices updated to the latest supported Cumulocity Microservice SDK version to benefit from current functionality, security improvements, and support for credential/configuration updates.
-
Avoid Static Caching: Where applicable, design microservices to retrieve tenant options dynamically rather than permanently caching credentials in memory at startup. This helps ensure that credential rotation can take effect without unnecessary service disruption.
-
Document: Clearly document which tenant options contain credentials, how they are used, and how they can be rotated. Provide recommended rotation intervals to tenant administrators.
-
Follow Least Privilege: Ensure credentials used by the microservice have only the permissions required for their intended purpose.
Important Note
No security incident has been identified or reported as a result of this advisory. This communication is a preventive measure issued in the interest of our customers.
Customer microservices can remain deployed and their configurations can remain unchanged for long periods of time. Forgotten or outdated configurations, particularly long-lived credentials, can increase the potential impact if those credentials are ever exposed or compromised.
We therefore encourage all customers to use this advisory as an opportunity to review their existing microservice versions, tenant options, and credential configurations, and to establish an appropriate credential rotation and review process.
Encrypted tenant options protect any sensitive information used by microservices at rest. Regular review, rotation, and removal of obsolete credentials adheres to the defense in depth principle and additional protection throughout their lifecycle.