CVE-2026-59385
Received Received - Intake

VMware Cloud Foundry Space-Scoped Broker Credential Exposure

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VMware

Description
A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-59385
EUVD
EUVD-2026-113755

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Cloud Foundry CAPI (Cloud Foundry Controller) 0
Cloud Foundry CF Deployment 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

A Space Developer with privileges in Cloud Foundry can modify the URL of a space-scoped broker to redirect it to a broker they control. This allows them to extract existing broker credentials indirectly, even though the API does not permit direct reading of these credentials.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to broker credentials, potentially allowing attackers to gain control over services or data managed by those brokers. This could result in data breaches or service disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations must address this to maintain data protection and regulatory compliance.

Mitigation Strategies

Upgrade CAPI (Cloud Foundry Controller) to v1.248.0 or later and cf-deployment to v60.9.0 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59385. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart