CVE-2026-59388

Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...

CVE-2026-59387

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/dropletcompleted and...

CVE-2026-59387

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/dropletcompleted and...

CVE-2026-59387 Broken access control restriction in Cloud Controller API

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/dropletcompleted and...

CVE-2026-59387

The Cloud Foundry Controller (CAPI) , specifically versions up to and including v1.245.0 , contains a broken access control restriction in its Nginx routing configuration. While internal endpoints for /internal/v4/ and /internal/v5/ are protected, the configuration omits a deny rule for /internal...

CVE-2026-59387 Broken access control restriction in Cloud Controller API

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/dropletcompleted and...

EUVD-2026-113756

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/dropletcompleted and...

CVE-2026-59388 Cloud Controller exposes secrets in audit log

Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...

CVE-2026-59388

Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...

CVE-2026-59388 Cloud Controller exposes secrets in audit log

Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...

EUVD-2026-113754

Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...

CVE-2026-59388

The Cloud Controller (CAPI) for Cloud Foundry suffers from a vulnerability where sensitive secrets are leaked into audit logs. Specifically, custom buildpack credentials are exposed during application manifest application, creation, and updates. Additionally, syslog drain URL credentials are leak...

CVE-2026-59388: Cloud Foundry Foundation: Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are…

Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...

CVE-2026-59387: Cloud Foundry: The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/…

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/dropletcompleted and...

PT-2026-133312

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet completed and...

PT-2026-133313

Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...

CVE-2026-59387 - broken access control restriction in Cloud Controller API | Cloud Foundry

Severity High CVSS score: 8.8 High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.245.0 inclusive Description The Nginx routing configuration for Cloud Controller blocks unauthenticated acce...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cluster-api-azure-controller, helm-operator, kyverno-notation-aws, flux-helm-controller, k3s, cloud-provider-aws, rke2-cloud-provider, metallb, kots, caddy, tekton-pipelines, tetragon, cluster-api-ipam-provider-in-cluster, metrics-server, kube-state-metrics,...

GO-2025-3774 vulnerabilities

Vulnerabilities for packages: emissary, rancher-system-agent, kubernetes-csi-driver-hostpath, rancher-fleet, yunikorn-k8shim, docker-machine-driver-harvester, vcluster, cloud-provider-gcp-cloud-controller-manager, mesosphere-vsphere-csi...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kuberlr, aws-application-networking-k8s, clickhouse-operator, lazydocker, nginx-prometheus-exporter, flux, emissary, kapp-controller, eksctl, kubernetes-dashboard-api, portieris, gcsfuse, buildkitd, zot, conftest, cerbos, cloud-sql-proxy, cloud-provider-vsphere,...