6.5Medium
CVE-2026-59386Credential exposure to space supporter
Description
A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.
Weakness (CWE):
CWE-269
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Cloud Foundry | cf-deployment | < v60.9.0 | |
| Cloud Foundry | Cloud Foundry Controller (CAPI) | ≤ 1.247.0 |