What’s Vulnerable › Vulnerabilities

CVE-2019-3782: CredHub CLI writes environment variable credentials to disk

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-02-13 · updated 2026-06-17
• Weakness: CWE-522

Description

Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.

Affected products

• Cloud Foundry CredHub CLI: before 2.2.1 — fixed in 2.2.1

How to fix

Upgrade to a fixed version: Cloud Foundry CredHub CLI 2.2.1. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/107038
• https://www.cloudfoundry.org/blog/cve-2019-3782
• http://www.securityfocus.com/bid/107038
• https://www.cloudfoundry.org/blog/cve-2019-3782

Get alerted when CVE-2019-3782 or the next vulnerability affects your stack