What’s Vulnerable › Vulnerabilities
CVE-2018-15763: PKS leaks IaaS Credentials to Application Logs
- Severity: high (CVSS 8.8 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-10-05 · updated 2026-06-17
- Weakness: CWE-532
Description
Pivotal Container Service, versions prior to 1.2.0, contains an information disclosure vulnerability which exposes IaaS credentials to application logs. A malicious user with access to application logs may be able to obtain IaaS credentials and perform actions using these credentials.
Affected products
- Pivotal Container Service (PKS): before 1.2 — fixed in 1.2
How to fix
Upgrade to a fixed version: Pivotal Container Service (PKS) 1.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2018-15763 or the next vulnerability affects your stack