CVE-2026-59387
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
68/100
Published: 2026-10-30
Modified: 2026-10-30
First seen: 2026-10-30
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.
Affected Software (4)
| Vendor | Product | Version |
|---|---|---|
| Cloud Foundry | CAPI (Cloud Controller API) | 0 < v1.247.0 |
| Cloud Foundry | CAPI (Cloud Controller API) | 0 < v1.247.0 |
| Cloud Foundry | cf-deployment | 0 < 60.7.0 |
| Cloud Foundry | cf-deployment | 0 < 60.7.0 |