CVE Feed

    Dashboard / CVE / CVE-2026-59386

    CVE-2026-59386

    A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.

    Published:Oct 30, 2026
    Last Modified:Oct 30, 2026
    EPS:Oct 30, 2026
    EPSS Score:0.00234
    CVSS Score:6.5

    Affected Products

    Vendor
    Cloudfoundry
    Product
    Cf-deployment
    Vendor
    Cloudfoundry
    Product
    Cloud Controller

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-269 Improper Privilege Management

    Related CVEs

    CVE-2026-59387 (CVSS 8.8) — The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /inter…
    CVE-2026-59385 (CVSS 2.7) — A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its crede…
    CVE-2026-59388 (CVSS 6.5) — Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentia…
    CVE-2026-59396 (CVSS 6.9) — A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA re…
    CVE-2026-59357 (CVSS 6.5) — Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry …
    CVE-2026-59358 (CVSS 7.6) — Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authentica…
    CVE-2026-47839 (CVSS 9.2) — A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope de…
    CVE-2026-47840 (CVSS 9.3) — A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certi…
    CVE-2026-41005 (CVSS 9) — Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute…
    CVE-2026-40965 (CVSS 10) — Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server cont…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High