CVE-2026-59388
Medium · 6.5CVSS
6.5
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62347 Element Call is a native Matrix video conferencing application. CWE-532
- CVE-2026-119117 Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for… CWE-532
- CVE-2026-119290 Zuke is a code-first, strongly typed build automation system for Deno. CWE-532
- CVE-2026-90861 Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may… CWE-532
- CVE-2026-118647 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable… CWE-532
- CVE-2026-79656 A user with read access to Grafana's server logs, or to a log store they are shipped to… CWE-532
- CVE-2026-116691 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-532
- CVE-2026-108328 Tanium addressed an insertion of sensitive information into log file vulnerability in… CWE-532