This vulnerability (CVE-2026-40964) involves improper authentication (CWE-287) in the cf-auth-proxy of Cloud Foundry Foundation's log-cache_release. An attacker can bypass authentication by crafting a JWT token accepted as a valid logs.admin token, thereby gaining unauthorized read access to all logs and metrics across applications and platform components. The flaw affects all log-cache_release versions up to and including 3.2.6 and CF Deployment versions up to and including 55.x.0. The issue was fixed in log-cache_release version 3.2.7 and CF Deployment version 55.x.0 or later, which bundles the fixed log-cache_release. No official remediation level or patch links were provided in the source data.

An unauthenticated remote attacker can read all logs and metrics for every application and platform component in affected Cloud Foundry deployments. This exposure can lead to information disclosure of sensitive operational data, potentially aiding further attacks or reconnaissance. The vulnerability does not impact integrity or availability but compromises confidentiality.

A fix is available in log-cache_release version 3.2.7 and CF Deployment version 55.x.0 or later, which includes the patched log-cache_release. Users should upgrade to these versions or later to remediate the vulnerability. Patch status is not explicitly confirmed by a vendor advisory in the provided data; therefore, verify with the Cloud Foundry Foundation's official advisories for the latest remediation guidance.