Broken access control restriction in Cloud Controller API
Affects Cloud Foundry CAPI up to and including v1.245.0 where the Nginx routing for Cloud Controller lacks a deny rule for /internal/v3/ endpoints. Fixed in CAPI v1.247.0 and cf-deployment 60.7.0.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in v1.247.0, 60.7.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The Cloud Controller API, the component of Cloud Foundry that manages apps, droplets, and staging, is affected. An attacker who knows a build or droplet ID can reach internal staging callback endpoints without authentication, forge completion messages, and write arbitrary metadata, which allows a lower-privileged user such as a SpaceAuditor to escalate privileges beyond their intended role.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Cloud Foundry CAPI (Cloud Controller API)
fixed in v1.247.0
- Cloud Foundry cf-deployment
fixed in 60.7.0
References 1
Questions about CVE-2026-59387
What does this mean?
A forged staging callback can move a droplet to STAGED and store arbitrary process and sidecar metadata with no associated package or actor. An attacker needs a valid build or droplet GUID, and the result is privilege escalation beyond the intended role boundary.Source: cloudfoundry.org
Am I affected, and how do I check?
CAPI versions up to and including v1.245.0 are listed as affected, along with Nginx routing configurations for Cloud Controller that lack a deny rule for /internal/v3/ endpoints. To check, look at the CAPI version in use and whether the Nginx configuration denies /internal/v3/ requests.Source: cloudfoundry.org
What should I do about it?
Upgrade CAPI to v1.247.0 or cf-deployment to 60.7.0, which are the listed fixed versions.Source: cloudfoundry.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Why do the sources disagree?
The sources conflict on the attack prerequisite. One describes the vector as unauthenticated, while the CVSS vector records PR:L, which means low privileges are required.Source: cloudfoundry.org