Skip to content
CVE PROGRAM SOURCE RECORD2.7 Low

CVE-2026-59385

Space Developer can extract space-scoped broker credentials

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cloud Foundry CAPI (Cloud Foundry Controller)

  • 0 to < v1.248.0affected

Cloud Foundry CF Deployment

  • 0 to < 60.9.0affected

References