CVE-2026-47832: OpenStack Application Credentials Logged in Cleartext to BOSH Debug Logs
The vulnerability lies in the way application credentials are handled within the BOSH deployment. bosh-openstack-cpi-release: all versions from v55 to v55.0.4 (inclusive)
Event History
Frequently Asked Questions
Which deployments are affected?
The affected range is bosh-openstack-cpi-release versions v55 through v55.0.4, inclusive. The issue concerns application credentials handled within a BOSH deployment.
What access would an attacker need to exploit this?
The provided data indicates low privileges are required and no user interaction is needed. It does not specify the exact access needed to obtain or view the BOSH debug logs containing the credentials.
How can I determine whether credentials may have been exposed?
Check whether the deployment uses bosh-openstack-cpi-release v55 through v55.0.4 and review BOSH debug logs for OpenStack application credentials recorded in cleartext. The provided data does not identify specific log locations or credential field names.