TI-2026-82965 Aliases CVE-2026-59388 GHSA-8p38-wrq5-f9qc

Cloud Foundry Cloud Controller writes secrets to audit logs

LOW 29CWE-532Published 2026-10-30 · Updated 2026-10-30

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

Cloud Foundry CAPI (Cloud Foundry Controller) before v1.249.0 and cf-deployment before 60.11.0 write sensitive data into audit logs (CWE-532). Custom buildpack credentials, syslog drain URL credentials and service binding parameters appear in audit events for app manifest, user-provided service instance and service binding actions. An attacker with low privileges over the network can read these secrets from the audit events.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00299 22nd percentileScored 2026-11-07

Fix Fixed CAPI (Cloud Foundry Controller) (Cloud Foundry Foundation): v1.249.0cf-deployment (Cloud Foundry Foundation): 60.11.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cloud Foundry Foundation	CAPI (Cloud Foundry Controller)	before v1.249.0	v1.249.0	Patch available	CNA
Cloud Foundry Foundation	cf-deployment	before 60.11.0	60.11.0	Patch available	CNA

CAPI (Cloud Foundry Controller) VendorCloud Foundry Foundation Affected before v1.249.0 Fixed in v1.249.0 Patch available CNA
cf-deployment VendorCloud Foundry Foundation Affected before 60.11.0 Fixed in 60.11.0 Patch available CNA

Remediation

Upgrade CAPI to v1.249.0 and cf-deployment to 60.11.0, which fix the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Fix · CNA CAPI (Cloud Foundry Controller) (Cloud Foundry Foundation) Fixed in v1.249.0
Fix · CNA cf-deployment (Cloud Foundry Foundation) Fixed in 60.11.0

Timeline

2026-10-30 Threatist record created from CVE-2026-59388
2026-10-30 Affected versions changed · CNA
2026-10-30 Alias added: GHSA-8p38-wrq5-f9qc
2026-10-30 Weakness changed · CISA ADP
2026-10-30 CISA SSVC decision points changed
2026-10-30 Priority changed: MEDIUM → LOW

References

Other 1

https://www.cloudfoundry.org/blog/cve-2026-59388-cloud-controller-exposes-secrets-in-audit-log/

TI-2026-29616 Information disclosure in Cloud Foundry Foundation uaa_release CVSS 4.0CRITICAL 10.0
TI-2026-35291 Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin CVSS 4.0CRITICAL 9.2
TI-2026-29615 Improper authentication in Cloud Foundry Foundation log-cache_release CVSS 3.1HIGH 7.5
TI-2026-35283 Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite CVSS 4.0HIGH 8.5
TI-2026-35280 CVE-2026-47827 – BOSH CLI Powershell Injection CVSS 3.1HIGH 7.5
TI-2026-29662 OS command injection in Cloud Foundry Foundation BOSH CVSS 4.0HIGH 8.7

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences