CVE-2026-59388: Cloud Controller exposes secrets in audit log
Published Oct 30, 2026
·Updated
Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.
Event History
Oct 30, 2026
CVE Published
via MITRE·08:40 AM
Data Sourced
via MITRE·08:40 AM
DescriptionSeverity
Data Sourced
via NVD·09:17 AM
DescriptionSeverity
Data Sourced
via NVD·09:17 AM
Weakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
Exploitation requires low-level privileges and network access. No user interaction is required, and the attack complexity is low.
2
What is the expected security impact?
The issue has a high confidentiality impact because sensitive data can be exposed through audit logs. It has no indicated integrity or availability impact.