CVE-2026-59385

Full vulnerability record from the local CVENow database.

Description

A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.

Severity

LOW

CVSS score

2.7 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-10-30 09:17:14.643000

Last modified

2026-10-30 17:44:35.820000

View original CVE JSON

{
  "id": "CVE-2026-59385",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-30T09:17:14.643",
  "lastModified": "2026-10-30T17:44:35.820",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Cloud Foundry",
          "product": "CAPI (Cloud Foundry Controller)",
          "versions": [
            {
              "version": "0",
              "lessThan": "v1.248.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Cloud Foundry",
          "product": "CF Deployment",
          "versions": [
            {
              "version": "0",
              "lessThan": "60.9.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 2.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-30T16:55:09.619821Z",
          "id": "CVE-2026-59385",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.cloudfoundry.org/blog/cve-2026-59385-space-developer-can-extract-space-scoped-broker-credentials/",
      "source": "[email protected]"
    }
  ]
}