Vulnerability Disclosure Report
Severity
High
CVSS Score
7.3 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Vendor
CloudFoundry Foundation
Versions Affected
bosh-openstack-cpi-release
- All versions from v55 to v55.0.4 (inclusive)
Description
The vulnerability lies in the way application credentials are handled within the BOSH deployment.
The application_credential_secret used by the CPI to authenticate with OpenStack is inadvertently written in cleartext within the BOSH task debug log on every CPI invocation. This constitutes a significant information leak of sensitive application secrets.
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:
bosh-openstack-cpi-release
- Upgrade to versions v55.1.0 or greater.
Credit
N/A
History
Initial vulnerability report published: 11/10/2026.
