CVE Feed

    Dashboard / CVE / CVE-2026-59388

    CVE-2026-59388

    Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.

    Published:Oct 30, 2026
    Last Modified:Oct 30, 2026
    EPS:Oct 30, 2026
    EPSS Score:0.00299
    CVSS Score:6.5

    Affected Products

    Vendor
    Cloudfoundry
    Product
    Cf-deployment
    Vendor
    Cloudfoundry
    Product
    Cloud Controller

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-215 Fuzzing for application mapping

    Related CVEs

    CVE-2026-59387 (CVSS 8.8) — The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /inter…
    CVE-2026-59385 (CVSS 2.7) — A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its crede…
    CVE-2026-59386 (CVSS 6.5) — A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceD…
    CVE-2026-59396 (CVSS 6.9) — A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA re…
    CVE-2026-59357 (CVSS 6.5) — Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry …
    CVE-2026-59358 (CVSS 7.6) — Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authentica…
    CVE-2026-47839 (CVSS 9.2) — A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope de…
    CVE-2026-47840 (CVSS 9.3) — A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certi…
    CVE-2026-41005 (CVSS 9) — Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute…
    CVE-2026-40965 (CVSS 10) — Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server cont…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High