{"id":"CVE-2026-59385","title":"Space Developer can extract space-scoped broker credentials","summary":"A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does…","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","vendor":"Cloud Foundry","product":"CAPI (Cloud Foundry Controller)","affected":["capi_cloud_foundry_controller < v1.248.0","cf_deployment < 60.9.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T16:55:09.619821Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T16:55:29.935Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59385","references":[{"url":"https://www.cloudfoundry.org/blog/cve-2026-59385-space-developer-can-extract-space-scoped-broker-credentials/"}],"tags":["cve.org"],"epss":0.00179,"epssPercentile":0.07511,"ingestedAt":"2026-11-05T16:24:31.101Z","slug":"CVE-2026-59385","body":"## Overview\n\nA user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.\n\n## Affected\n\n- `capi_cloud_foundry_controller < v1.248.0`\n- `cf_deployment < 60.9.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}