Cloud Foundry CAPI: Broken access control in Cloud Controller API
Summary
The Nginx routing for the Cloud Controller API blocks unauthenticated access to /internal/v4/ and /internal/v5/ but not to /internal/v3/. The staging callback endpoints under /internal/v3/ are therefore reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can submit forged staging callbacks, set a droplet to STAGED and store arbitrary process metadata and sidecar data, and a SpaceAuditor who can enumerate GUIDs without write permissions can use this to exceed their role.
Affected
- CAPI (Cloud Controller API) before v1.247.0 according to the CVE record (the vendor advisory confirms versions up to and including v1.245.0)
- cf-deployment before 60.7.0
Fixed in
- CAPI v1.246.0 or later (vendor advisory)
- cf-deployment v60.7.0 or later (includes CAPI v1.247.0)
Workaround
Unknown. No vendor-documented workaround could be verified.
- Make sure the public API listener does not route any /internal/ paths, including /internal/v3/.
- As a temporary measure, block /internal/ paths at the load balancer or reverse proxy, and test this first in a non-production environment.
Exploitation
- No known exploitation in the wild.
- No public exploit known.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
Our recommendation
- Check whether CAPI or cf-deployment is in use, directly or via a managed platform.
- Upgrade CAPI to v1.246.0 or later, or cf-deployment to v60.7.0 or later.
- Until patched, restrict SpaceAuditor and similar roles and review edge logs for requests to /internal/v3/ (suggested check, not a confirmed indicator of compromise).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cloud Foundry Security Advisory CVE-2026-59387 www.cloudfoundry.org
- cf-deployment Release v60.7.0 github.com
- capi-release Release 1.247.0 github.com
- VulDB CVE-2026-59387 vuldb.com
- Vulners CVE-2026-59387 (Cloud Foundry) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:45.
Original description (NVD)
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.