Read the docs
TI-2026-82967 Aliases CVE-2026-59387GHSA-37xc-gw75-236w

Broken access control in Cloud Foundry Cloud Controller API

Priority MEDIUM 40CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Cloud Foundry CAPI (Cloud Controller API) before v1.247.0 and cf-deployment before 60.7.0 are affected. The Nginx routing configuration does not block unauthenticated access to the /internal/v3/ staging callback endpoints, so they are reachable from the public API listener without OAuth or mutual TLS, which is an improper access control flaw (CWE-284). An attacker with a valid build or droplet GUID can submit a forged staging callback to mark a droplet as STAGED and store arbitrary process metadata, and a SpaceAuditor can enumerate those GUIDs without write permissions, which allows privilege escalation beyond the intended role.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.   An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00232 14th percentileScored 2026-11-07
Fix Fixed CAPI (Cloud Controller API) (Cloud Foundry): v1.247.0cf-deployment (Cloud Foundry): 60.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cloud FoundryCAPI (Cloud Controller API)before v1.247.0v1.247.0Patch availableCNA
Cloud Foundrycf-deploymentbefore 60.7.060.7.0Patch availableCNA
  • CAPI (Cloud Controller API) VendorCloud Foundry Affected before v1.247.0 Fixed in v1.247.0 Patch available CNA
  • cf-deployment VendorCloud Foundry Affected before 60.7.0 Fixed in 60.7.0 Patch available CNA

Remediation

Upgrade CAPI (Cloud Controller API) to v1.247.0 and cf-deployment to 60.7.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA CAPI (Cloud Controller API) (Cloud Foundry) Fixed in v1.247.0
  • Fix · CNA cf-deployment (Cloud Foundry) Fixed in 60.7.0

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-59387
  2. 2026-10-30 Alias added: GHSA-37xc-gw75-236w
  3. 2026-10-30 CISA SSVC decision points changed
  4. 2026-10-30 Priority changed: MEDIUM → LOW
  5. 2026-10-30 Weakness changed · CISA ADP
  6. 2026-10-31 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2018-11240 UAA Privilege Escalation CVSS 3.0CRITICAL 9.9
  • TI-2018-01169 Log Cache logs UAA client secret on startup CVSS 3.0CRITICAL 9.8
  • TI-2018-07868 Cloud Foundry UAA MFA does not prevent brute force of MFA code CVSS 3.0CRITICAL 9.8
  • TI-2026-18259 Cloud Foundry UAA SAML 2.0 Signature Bypass CVSS 3.1HIGH 8.6
  • TI-2019-02813 Java Projects using HTTP to fetch dependencies CVSS 3.1CRITICAL 9.8
  • TI-2024-24613 Authentication bypass by spoofing in Cloud Foundry haproxy-boshrelease CVSS 3.1CRITICAL 9.1
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences