Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Cloud Foundry Controller (CAPI) by Cloud Foundry

    CVE-2026-59386 (GCVE-0-2026-59386)

    Vulnerability from nvd – Published: 2026-10-30 08:35 – Updated: 2026-10-30 16:56
    VLAI
    Title
    Credential exposure to space supporter
    Summary
    A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-30 16:56 UTC
    CWE
    • CWE-269 - Improper Privilege Management
    Assigner
    vmware CNA under the mitre root
    CNA scorecard C 64/100 over 233 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59386",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T16:56:35.592889Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T16:56:57.050Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cloud Foundry Controller (CAPI)",
          "vendor": "Cloud Foundry",
          "versions": [
            {
              "lessThanOrEqual": "1.247.0",
              "status": "affected",
              "version": "0",
              "versionType": "OSS"
            }
          ]
        },
        {
          "product": "cf-deployment",
          "vendor": "Cloud Foundry",
          "versions": [
            {
              "lessThan": "v60.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "oss"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA SpaceSupporter could improperly modify an application\u0027s start command and buildpack\u2014actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.\u003c/p\u003e"
            }
          ],
          "value": "A SpaceSupporter could improperly modify an application\u0027s start command and buildpack\u2014actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T08:35:20.435Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://www.cloudfoundry.org/blog/cve-2026-59386-credential-exposure-to-space-supporter/"
        }
      ],
      "title": "Credential exposure to space supporter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59386",
    "datePublished": "2026-10-30T08:35:20.435Z",
    "dateReserved": "2026-07-04T18:15:19.504Z",
    "dateUpdated": "2026-10-30T16:56:57.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-59386 (GCVE-0-2026-59386)

    Vulnerability from cvelistv5 – Published: 2026-10-30 08:35 – Updated: 2026-10-30 16:56
    VLAI
    Title
    Credential exposure to space supporter
    Summary
    A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-30 16:56 UTC
    CWE
    • CWE-269 - Improper Privilege Management
    Assigner
    vmware CNA under the mitre root
    CNA scorecard C 64/100 over 233 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59386",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T16:56:35.592889Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T16:56:57.050Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cloud Foundry Controller (CAPI)",
          "vendor": "Cloud Foundry",
          "versions": [
            {
              "lessThanOrEqual": "1.247.0",
              "status": "affected",
              "version": "0",
              "versionType": "OSS"
            }
          ]
        },
        {
          "product": "cf-deployment",
          "vendor": "Cloud Foundry",
          "versions": [
            {
              "lessThan": "v60.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "oss"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA SpaceSupporter could improperly modify an application\u0027s start command and buildpack\u2014actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.\u003c/p\u003e"
            }
          ],
          "value": "A SpaceSupporter could improperly modify an application\u0027s start command and buildpack\u2014actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T08:35:20.435Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://www.cloudfoundry.org/blog/cve-2026-59386-credential-exposure-to-space-supporter/"
        }
      ],
      "title": "Credential exposure to space supporter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-59386",
    "datePublished": "2026-10-30T08:35:20.435Z",
    "dateReserved": "2026-07-04T18:15:19.504Z",
    "dateUpdated": "2026-10-30T16:56:57.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}