CVE-2026-59386
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.
Risk Assessment
A SpaceSupporter can exploit this to obtain service credentials that should not be accessible to them, violating role boundaries and data confidentiality.
Recommendation
Upgrade the Cloud Foundry platform to a version containing the fix. Until deployed, consider restricting SpaceSupporter roles or monitoring changes to start commands and buildpacks.
Other vulnerabilities in Cloud Foundry
See all- CVE-2026-59385Low
A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.
- CVE-2026-40964High
An authentication bypass vulnerability in cf-auth-proxy in Cloud Foundry Foundation allows an unauthenticated remote attacker to read all logs and metrics for every application and platform component by minting a JWT accepted as a valid logs.admin token.
Original NVD description (English source)
A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS