CVE-2026-59386

Full vulnerability record from the local CVENow database.

Description

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.

Severity

MEDIUM

CVSS score

6.5 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-10-30 09:17:14.790000

Last modified

2026-10-30 09:17:14.790000

View original CVE JSON

{
  "id": "CVE-2026-59386",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-30T09:17:14.790",
  "lastModified": "2026-10-30T09:17:14.790",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Cloud Foundry",
          "product": "Cloud Foundry Controller (CAPI)",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.247.0",
              "versionType": "OSS",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Cloud Foundry",
          "product": "cf-deployment",
          "versions": [
            {
              "version": "0",
              "lessThan": "v60.9.0",
              "versionType": "oss",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.2
      }
    ]
  },
  "references": [
    {
      "url": "https://www.cloudfoundry.org/blog/cve-2026-59386-credential-exposure-to-space-supporter/",
      "source": "[email protected]"
    }
  ]
}