Sensitive Data Exposure in Cloud Controller by Cloud Foundry

CVE-2026-59388

What is CVE-2026-59388?

The Cloud Controller (CAPI) in Cloud Foundry has a vulnerability that results in the leakage of sensitive information into its audit logs across multiple instances. This includes the exposure of custom buildpack credentials during application manifest creation and updates, as well as syslog drain URL credentials in user-provided service instance audit events. Additionally, sensitive service binding parameters are revealed in both app manifest and service binding audit events, potentially compromising application security and user data integrity.

References