---
id: CVE-2026-59387
title: Broken access control restriction in Cloud Controller API
summary: >-
  The Nginx routing configuration for Cloud Controller blocks unauthenticated
  access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent
  deny rule for /internal/v3/. As a result, the staging callback endpoints
  /internal/v3…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Cloud Foundry
product: CAPI (Cloud Controller API)
affected:
  - capi_cloud_controller_api < v1.247.0
  - cf-deployment < 60.7.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T15:27:30.662530Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T20:10:53.458Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-59387'
references:
  - url: >-
      https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/
tags:
  - cve.org
epss: 0.00232
epssPercentile: 0.14144
ingestedAt: '2026-11-05T16:24:31.456Z'
---

## Overview

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.



 



An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.

## Affected

- `capi_cloud_controller_api < v1.247.0`
- `cf-deployment < 60.7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.