TI-2026-82966 Aliases CVE-2026-59385 GHSA-mvr6-3j94-gvw8

Space Developer can extract space-scoped broker credentials

LOW 13CWE-639Published 2026-10-30 · Updated 2026-10-30

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Cloud Foundry CAPI (Cloud Foundry Controller) before v1.248.0 and CF Deployment before 60.9.0 let a user with SpaceDeveloper privileges change the URL of a space-scoped broker without changing its credentials. The user can redirect the existing broker credentials to a broker they control, which extracts them indirectly because the CF API does not allow reading broker credentials directly. The flaw is an authorization bypass through a user-controlled key (CWE-639). An attacker needs an account with SpaceDeveloper privileges on the space.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00179 7th percentileScored 2026-11-07

Fix Fixed CAPI (Cloud Foundry Controller) (Cloud Foundry): v1.248.0CF Deployment (Cloud Foundry): 60.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cloud Foundry	CAPI (Cloud Foundry Controller)	before v1.248.0	v1.248.0	Patch available	CNA
Cloud Foundry	CF Deployment	before 60.9.0	60.9.0	Patch available	CNA

CAPI (Cloud Foundry Controller) VendorCloud Foundry Affected before v1.248.0 Fixed in v1.248.0 Patch available CNA
CF Deployment VendorCloud Foundry Affected before 60.9.0 Fixed in 60.9.0 Patch available CNA

Remediation

Upgrade CAPI (Cloud Foundry Controller) to v1.248.0 and CF Deployment to 60.9.0 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Fix · CNA CAPI (Cloud Foundry Controller) (Cloud Foundry) Fixed in v1.248.0
Fix · CNA CF Deployment (Cloud Foundry) Fixed in 60.9.0

Timeline

2026-10-30 Threatist record created from CVE-2026-59385
2026-10-30 Alias added: GHSA-mvr6-3j94-gvw8
2026-10-30 Weakness changed · CISA ADP
2026-10-30 CISA SSVC decision points changed

References

Other 1

https://www.cloudfoundry.org/blog/cve-2026-59385-space-developer-can-extract-space-scoped-broker-credentials/

TI-2018-11240 UAA Privilege Escalation CVSS 3.0CRITICAL 9.9
TI-2018-01169 Log Cache logs UAA client secret on startup CVSS 3.0CRITICAL 9.8
TI-2018-07868 Cloud Foundry UAA MFA does not prevent brute force of MFA code CVSS 3.0CRITICAL 9.8
TI-2026-18259 Cloud Foundry UAA SAML 2.0 Signature Bypass CVSS 3.1HIGH 8.6
TI-2019-02813 Java Projects using HTTP to fetch dependencies CVSS 3.1CRITICAL 9.8
TI-2024-24613 Authentication bypass by spoofing in Cloud Foundry haproxy-boshrelease CVSS 3.1CRITICAL 9.1

See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences