Description
Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cloud Foundry | CF CLI | All – < v6.43.0 | v6.43.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | cf-cli | 6.43.0-3.3.2 | SUSE-SU-2019:1220-2 |
| SLES 15 | cf-cli | 6.43.0-3.3.2 | SUSE-SU-2019:1220-1 |
Advisories 2
- SUSE-SU-2019:1220-2 Security update for cf-cli SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1220-1 Security update for cf-cli SUSE / openSUSE Security Updates · Feb 4, 2026