{"id":"CVE-2026-59388","kind":"vulnerability","aliases":["CVE-2026-59388"],"related":[],"title":"Cloud Foundry CAPI: audit logs expose buildpack, syslog and service credentials","description":"Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.","summary":"Cloud Controller (CAPI), the Cloud Foundry API component, writes secrets into audit events: custom buildpack credentials, syslog drain URL credentials and service binding parameters. Anyone who can read those audit events can obtain the credentials.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["capi","cloud-foundry","infrastructure","self-hosted"],"not_affected_if":["audit-log-access-restricted","no-custom-buildpack-credentials","no-syslog-drain-credentials"],"how_to_check":"- Check the Cloud Controller (CAPI) release version in your Cloud Foundry deployment, e.g. `bosh deployments` and the capi release version\n- Review who can read audit events, e.g. `cf audit-events` for users with audit read roles","fix":null,"status":"open","published_at":"2026-10-30T09:17:15+00:00","first_seen_at":"2026-10-30T09:29:39+00:00","triaged_at":"2026-10-30T09:30:36+00:00","updated_at":"2026-10-30T09:30:36+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-30T09:30:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Cloud Foundry CAPI: audit logs expose buildpack, syslog and service credentials","impact":"medium","summary":"Cloud Controller (CAPI), the Cloud Foundry API component, writes secrets into audit events: custom buildpack credentials, syslog drain URL credentials and service binding parameters. Anyone who can read those audit events can obtain the credentials.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cloud-foundry","capi","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"credentials readable from audit logs by anyone with audit access","analyst_note":"Sources name no fixed CAPI version or patch; check the NVD entry and Cloud Foundry release notes for the fixed version.","how_to_check":"- Check the Cloud Controller (CAPI) release version in your Cloud Foundry deployment, e.g. `bosh deployments` and the capi release version\n- Review who can read audit events, e.g. `cf audit-events` for users with audit read roles\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-custom-buildpack-credentials","no-syslog-drain-credentials","audit-log-access-restricted"],"who_is_affected":"Teams running Cloud Foundry deployments whose Cloud Controller writes audit events. Exposure depends on whether custom buildpacks with credentials, user-provided syslog drains, or service bindings with parameters are used, and on who can read audit logs. Deployments without those features may skip it. The sources do not list fixed versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000723,"input_tokens":4146,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-59388':14A,17A 'anyon':50B 'api':32B 'app':82C,109C 'applic':84C 'audit':4A,37B,55B,68C,79C,100C,114C 'bind':48B,104C,113C 'buildpack':7A,40B,74C 'capi':3A,18B,28B,63C 'cloud':1A,20B,26B,30B,61C 'cloud-foundri':19B 'compon':33B 'control':27B,62C 'creation':85C 'credenti':11A,41B,45B,60B,75C,91C 'custom':39B,73C 'cve':12A,15A 'data':66C 'drain':43B,89C 'event':38B,56B,80C,101C,115C 'expos':6A,77C,93C 'foundri':2A,21B,31B 'host':25B 'infrastructur':22B 'instanc':72C,99C 'leak':64C,107C 'log':5A,69C 'manifest':83C,110C 'multipl':71C 'obtain':58B 'paramet':49B,105C 'provid':97C 'read':53B 'secret':35B 'self':24B 'self-host':23B 'sensit':65C 'servic':10A,47B,98C,103C,112C 'syslog':8A,42B,88C 'updat':87C 'url':44B,90C 'user':96C 'user-provid':95C 'write':34B","nicknames":[],"mitigations":[],"who_affected":"Teams running Cloud Foundry deployments whose Cloud Controller writes audit events. Exposure depends on whether custom buildpacks with credentials, user-provided syslog drains, or service bindings with parameters are used, and on who can read audit logs. Deployments without those features may skip it. The sources do not list fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@vmware.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59388","severity":null,"published_at":"2026-10-30T09:17:15+00:00","modified_at":"2026-10-30T09:17:15+00:00","first_seen_at":"2026-10-30T09:29:39+00:00","fetched_at":"2026-10-30T09:29:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}