CVE-2026-59385
LOW
INFO
Priority: 0.01
BB Relevance:
50/100
Published: 2026-10-30
Modified: 2026-10-30
First seen: 2026-10-30
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
None
S:
Unchanged
C:
Low
I:
None
A:
None
Description
A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.
Weakness Classification (1)
Affected Software (4)
| Vendor | Product | Version |
|---|---|---|
| Cloud Foundry | CAPI (Cloud Foundry Controller) | 0 < v1.248.0 |
| Cloud Foundry | CAPI (Cloud Foundry Controller) | 0 < v1.248.0 |
| Cloud Foundry | CF Deployment | 0 < 60.9.0 |
| Cloud Foundry | CF Deployment | 0 < 60.9.0 |