Cloud Foundry log-cache CVE-2026-40964

Exploitation requires network reachability to the cf-auth-proxy fronting log-cache in a Cloud Foundry foundation running log-cache_release at or below v3.2.6 (or a CF Deployment that bundles it). No authentication, user interaction, special tenancy, or non-default configuration is needed - any Cloud Foundry install running the affected log-cache_release is exposed by default per the advisory's 'all installations' wording. The principal limiting factor is network exposure of the log-cache endpoint: deployments that publish log-cache only on an operator-internal network are reachable only by attackers already inside that perimeter, while installations exposing the endpoint to tenant networks or the internet are exploitable by any remote attacker. Impact is confidentiality-only (C:H/I:N/A:N), so successful exploitation yields read access to logs and metrics but not direct write or disruption of CF components.

The CVSS vector AV:N/AC:L/PR:N/UI:N paints a worst-case access profile: network-reachable, low complexity, no authentication, no user interaction - anyone who can reach the log-cache endpoint can attempt exploitation. Scope is Unchanged and impact is confidentiality-only (C:H/I:N/A:N), which correctly tempers the 7.5 base score: an attacker reads every log and metric but cannot modify or disrupt the platform directly. However, logs frequently contain secrets, tokens, internal hostnames, request bodies, and stack traces, so the practical confidentiality blast radius is severe and a strong stepping stone for follow-on attacks. The vector's E:P signals proof-of-concept exploit maturity per the CNA, though no public PoC was located in the supplied references; EPSS and KEV status were not provided in the input. There is no conflict between CVSS and the description - both indicate unauthenticated remote exploitation. Priority should be HIGH for any internet- or tenant-reachable log-cache deployment, MEDIUM where the endpoint is restricted to a trusted operator network.

An attacker with network reachability to the log-cache endpoint crafts a JWT that the cf-auth-proxy mistakenly accepts as carrying the logs.admin scope, then issues standard log-cache API queries to stream logs and metrics for every application and platform component in the foundation. The attacker harvests credentials, API tokens, internal URLs, and request payloads from log lines, then pivots to higher-impact compromise against the discovered systems. The CVSS vector E:P notes proof-of-concept code is known to the CNA, but no public exploit was identified in the supplied references at time of analysis.