CVE-2026-59388: Cloud Controller exposes secrets in audit log

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-30 · updated 2026-10-30
Weakness: CWE-532

Description

Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.

Affected products

Cloud Foundry Foundation CAPI (Cloud Foundry Controller): before v1.249.0 — fixed in v1.249.0
Cloud Foundry Foundation cf-deployment: before 60.11.0 — fixed in 60.11.0

How to fix

Upgrade to a fixed version: Cloud Foundry Foundation CAPI (Cloud Foundry Controller) v1.249.0; Cloud Foundry Foundation cf-deployment 60.11.0. Check the vendor advisory for mitigations.

References

https://www.cloudfoundry.org/blog/cve-2026-59388-cloud-controller-exposes-secrets-in-audit-log/

Get alerted when CVE-2026-59388 or the next vulnerability affects your stack