CVE-2026-59385
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.
Risk Assessment
A SpaceDeveloper can capture service broker credentials, potentially leading to unauthorized access to services and external systems associated with the broker.
Recommendation
Upgrade Cloud Foundry to a version containing the fix. Until deployed, restrict SpaceDeveloper privileges and monitor changes to space-scoped broker URLs.
Other vulnerabilities in Cloud Foundry
See all- CVE-2026-59386Medium
A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.
- CVE-2026-40964High
An authentication bypass vulnerability in cf-auth-proxy in Cloud Foundry Foundation allows an unauthenticated remote attacker to read all logs and metrics for every application and platform component by minting a JWT accepted as a valid logs.admin token.
Original NVD description (English source)
A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS