Cloud Controller logs environment variables from app manifests

published 2020-02-27 6y ago modified 2026-06-17 4mo ago also EUVD-2020-26579

cvss: 8.0; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits: 0; none known

Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.

Patch / fix

fixed in 1

Cloud Foundry CAPI 1.91.0

Is CVE-2020-5400 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.0	8.0	CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N

Affected products

Cloud Foundry CAPI

Classification

Weakness

CWE-522 Insufficiently Protected Credentials
CWE-532 Insertion of Sensitive Information into Log File

References

cloudfoundry.org /blog/cve-2020-5400
vendor-advisory

Sources

CVE List CVE-2020-5400
NVD CVE-2020-5400

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.