CVE-2018-1264

Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secret, gaining all privileges held by the Log Cache UAA client. In the worst case, if this client is an admin, the attacker would gain complete control over the Foundation.

• CWE-532

• https://www.cloudfoundry.org/blog/cve-2018-1264/Vendor Advisory
• https://www.cloudfoundry.org/blog/cve-2018-1264/Vendor Advisory

Published

Oct 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12632Redatam7 (formerly Redatam WebServer) allows remote attacker…
• CVE-2018-12633An issue was discovered in the Linux kernel through 4.17.2. …
• CVE-2018-12634CirCarLife Scada before 4.3 allows remote attackers to obtai…9.8
• CVE-2018-12635CirCarLife Scada v4.2.4 allows unauthorized upgrades via req…
• CVE-2018-12636The iThemes Security (better-wp-security) plugin before 7.0.…
• CVE-2018-12638An issue was discovered in the Bose Soundtouch app 18.1.4 fo…
• CVE-2018-12640The webService binary on Insteon HD IP Camera White 2864-222…9.8
• CVE-2018-12641An issue was discovered in arm_pt in cplus-dem.c in GNU libi…
• CVE-2018-12642Froxlor through 0.9.39.5 has Incorrect Access Control for ti…
• CVE-2018-12648The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/…
• CVE-2018-12649An issue was discovered in app/Controller/UsersController.ph…
• CVE-2018-1265Cloud Foundry Diego, release versions prior to 2.8.0, does n…