{"id":"CVE-2026-59387","title":"Broken access control restriction in Cloud Controller API","summary":"The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Cloud Foundry","product":"CAPI (Cloud Controller API)","affected":["capi_cloud_controller_api < v1.247.0","cf-deployment < 60.7.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-30T15:27:30.662530Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T20:10:53.458Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59387","references":[{"url":"https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/"}],"tags":["cve.org"],"epss":0.00232,"epssPercentile":0.14144,"ingestedAt":"2026-11-05T16:24:31.456Z","slug":"CVE-2026-59387","body":"## Overview\n\nThe Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.\n\n\n\n \n\n\n\nAn attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.\n\n## Affected\n\n- `capi_cloud_controller_api < v1.247.0`\n- `cf-deployment < 60.7.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}