Read the docs
TI-2026-82964 Aliases CVE-2026-59386GHSA-4ppv-vpf6-gfrj

Cloud Foundry flaw lets space supporters retrieve service credentials

Priority LOW 30CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-269.

Summary

Cloud Foundry Controller (CAPI) from 0 through 1.247.0 and cf-deployment from 0 before v60.9.0 are affected. Improper privilege management (CWE-269) lets a SpaceSupporter change an application's start command and buildpack, actions that require SpaceDeveloper privileges. The privilege escalation lets the SpaceSupporter retrieve service credentials.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00222 12th percentileScored 2026-11-07
Fix Partial cf-deployment (Cloud Foundry): v60.9.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cloud FoundryCloud Foundry Controller (CAPI)up to 1.247.0—No fix listedCNA
Cloud Foundrycf-deploymentbefore v60.9.0v60.9.0Patch availableCNA
  • Cloud Foundry Controller (CAPI) VendorCloud Foundry Affected up to 1.247.0 Fixed in — No fix listed CNA
  • cf-deployment VendorCloud Foundry Affected before v60.9.0 Fixed in v60.9.0 Patch available CNA

Remediation

Update cf-deployment to v60.9.0 or later. The sources list no fixed version for Cloud Foundry Controller (CAPI). Red Hat lists Red Hat OpenShift Container Platform 4 as affected with no plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA cf-deployment (Cloud Foundry) Fixed in v60.9.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-59386
  2. 2026-10-30 Alias added: GHSA-4ppv-vpf6-gfrj
  3. 2026-10-30 Weakness changed · CISA ADP
  4. 2026-10-30 CISA SSVC decision points changed
  5. 2026-10-30 Priority changed: MEDIUM → LOW
  6. 2026-10-30 Affected versions changed · Red Hat
  7. 2026-10-30 CVSS score added · Red Hat

References

Other 1

  • TI-2018-11240 UAA Privilege Escalation CVSS 3.0CRITICAL 9.9
  • TI-2018-01169 Log Cache logs UAA client secret on startup CVSS 3.0CRITICAL 9.8
  • TI-2018-07868 Cloud Foundry UAA MFA does not prevent brute force of MFA code CVSS 3.0CRITICAL 9.8
  • TI-2026-18259 Cloud Foundry UAA SAML 2.0 Signature Bypass CVSS 3.1HIGH 8.6
  • TI-2019-02813 Java Projects using HTTP to fetch dependencies CVSS 3.1CRITICAL 9.8
  • TI-2024-24613 Authentication bypass by spoofing in Cloud Foundry haproxy-boshrelease CVSS 3.1CRITICAL 9.1
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences