CVE-2026-59388
Cloud Controller exposes secrets in audit log
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.
| Vendor | cloud foundry foundation |
| Product | capi (cloud foundry controller) |
| Published | Oct 30, 2026 |
| Last Updated | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for cloud foundry foundation capi (cloud foundry controller)
Be the first to know when new medium vulnerabilities affecting cloud foundry foundation capi (cloud foundry controller) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Cloud Foundry Foundation / CAPI (Cloud Foundry Controller)
0 < v1.249.0
Cloud Foundry Foundation / cf-deployment
0 < 60.11.0