Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 30 Oct 2026 08:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events. | |
| Title | Cloud Controller exposes secrets in audit log | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: vmware
Published:
Updated: 2026-10-30T09:39:37.185Z
Reserved: 2026-07-04T18:15:19.504Z
Link: CVE-2026-59388
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-30T09:17:15.063
Modified: 2026-10-30T09:17:15.063
Link: CVE-2026-59388
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.