Live › vulnerability › CVE-2026-59388
Cloud Controller (CAPI), the Cloud Foundry API component, writes secrets into audit events: custom buildpack credentials, syslog drain URL credentials and service binding parameters. Anyone who can read those audit events can obtain the credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 09:29 UTC. All times on this page are UTC.
Teams running Cloud Foundry deployments whose Cloud Controller writes audit events. Exposure depends on whether custom buildpacks with credentials, user-provided syslog drains, or service bindings with parameters are used, and on who can read audit logs. Deployments without those features may skip it. The sources do not list fixed versions.
No product ranges from the sources yet.
bosh deployments and the capi release versioncf audit-events for users with audit read rolesNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.
This page as .md · .json · in your agent: get_signal("CVE-2026-59388")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.