Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-59387— Broken access control restriction in Cloud Controller API

Quick assessment

Affected
Cloud Foundry CAPI (Cloud Controller API)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cloud Controller 的 Nginx 路由配置已对 和 端点设置了规则，以阻止未认证访问，但遗漏了针对 的相应拒绝规则。因此，公共 API 监听器可在无需 OAuth 或双向 TLS 认证的情况下，访问 和 这两个打包回调端点。 拥有有效构建 GUID 或 Droplet GUID 的攻击者可以提交伪造的打包回调，将 Droplet 状态变更为 STAGED，并在没有关联包或执行者的情况下持久化任意的进程元数据及 Sidecar 数据。此外，拥有 SpaceAuditor 角色的用户可以枚举 GUID，

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59387

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Broken access control restriction in Cloud Controller API
Source: CVE Program / CVE List V5
Vulnerability Description
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.   An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Cloud Foundry CAPI (Cloud Controller API) 0 ~ v1.247.0 -
Cloud Foundry cf-deployment 0 ~ 60.7.0 -

II. Public POCs for CVE-2026-59387

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-59387

请登录查看更多情报信息。

Other References for CVE-2026-59387 (1)

Same Patch Batch · Cloud Foundry · 2026-10-30 · 4 CVEs total

CVE-2026-59386 6.5 MEDIUM Credential exposure to space supporter
CVE-2026-59396 4.9 MEDIUM DoS Vulnerability in UAA Related to JWKS URI Handling
CVE-2026-59385 2.7 LOW Space Developer can extract space-scoped broker credentials

IV. Related Vulnerabilities

Same vendor: Cloud Foundry