Severity
High
CVSS score: 6.5 (Medium) (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Vendor
Cloud Foundry Foundation
Versions Affected
CAPI (Cloud Foundry Controller)
– Confirmed in CAPI up to v1.248.0 (inclusive)
Description
Credentials for custom buildpacks leaked into audit events of type “audit.app.apply_manifest”, “audit.app.create” and “audit.app.update”.
Credentials for syslog drain URLs leaked into audit events of type “audit.user_provided_service_instance.create” and “audit.user_provided_service_instance.update”.
Service binding parameters leaked into audit events of type “audit.app.apply_manifest” and “audit.service_binding.*”. Service binding parameters are not credentials but service instance parameters are redacted from audit events so users would expect the same for service binding parameters.
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below.
The Cloud Foundry project recommends upgrading the following releases:
CAPI
– Upgrade CAPI to v1.249.0 or greater
CF Deployment
– Upgrade cf-deployment version to v60.11.0 or greater
– Includes CAPI v1.249.0
Credit
This issue was responsibly reported by Minseong Kim (mak3bread).
History
2026-10-20: Initial vulnerability report published.
