CVE-2026-40964 is an improper authentication vulnerability (CWE-287) in the cf-auth-proxy component of Cloud Foundry Foundation's log-cache_release. The issue allows an unauthenticated remote attacker to bypass authentication by minting a JSON Web Token (JWT) that the cf-auth-proxy accepts as a valid logs.admin token. This grants unauthorized read access to all logs and metrics across applications and platform components. The vulnerability affects all versions of log-cache_release up to and including v3.2.6 and CF Deployment versions up to v55.?.0. The fix was introduced in log-cache_release v3.2.7 and CF Deployment v55.?.0 or later, which bundles the patched log-cache_release. The CVSS 3.1 base score is 7.5, reflecting a high-severity remote network vulnerability with no required privileges or user interaction and high confidentiality impact.

An unauthenticated attacker can gain read access to all logs and metrics for every application and platform component in affected Cloud Foundry deployments. This exposure of sensitive operational data could lead to information disclosure, potentially aiding further attacks or reconnaissance. There is no indication of integrity or availability impact. No known exploits in the wild have been reported as of the published date.

A fix is available in log-cache_release version 3.2.7 and CF Deployment version 55.?.0 or later, which includes the patched log-cache_release. Users should upgrade to these versions or later to remediate the vulnerability. Patch status is not explicitly confirmed in the provided data; therefore, users should verify the current remediation guidance from the Cloud Foundry Foundation vendor advisory before proceeding.