CVE-2026-59385lowCWE-639

CVE-2026-59385: falha de baixa gravidade em Cloud Foundry CAPI (Cloud Foundry Controller)

Space Developer can extract space-scoped broker credentials

Publicada em

Seguir esta CVE+ Monitorar CF Deployment+ Monitorar CAPI

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.7epss 0.2%
A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Cloud Foundry · CAPI (Cloud Foundry Controller)Cloud Foundry · CF Deployment
CVEs relacionadas — Cloud Foundry CAPI (Cloud Foundry Controller)

No mesmo produto, das mais perigosas para as menos.

CVE-2019-11277HIGHVolume Services is vulnerable to an LDAP injection attackEPSS 1.7%CVE-2019-11283HIGHPassword leak in smbdriver logsEPSS 1.5%CVE-2020-5416HIGHCF clusters with NGINX in front of them may be vulnerable to DoSEPSS 1.2%CVE-2020-5420HIGHGorouter is vulnerable to DoS attack via invalid HTTP responsesEPSS 1.2%CVE-2020-5423HIGHCloud Controller is vulnerable to denial of service via YAML parsingEPSS 1.1%CVE-2019-11282MEDIUMUAA is vulnerable to a Blind SCIM injection leading to information disclosureEPSS 1.1%