CVE-2026-59387
Received Received - Intake

Unauthenticated Access to Cloud Controller Internal v3 Endpoints

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VMware

Description
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.   An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-59387
EUVD
EUVD-2026-113756

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Cloud Foundry CAPI (Cloud Controller API) 0
Cloud Foundry cf-deployment 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59387 is a broken access control vulnerability in Cloud Foundry's Cloud Controller API (CAPI). The Nginx routing configuration fails to block unauthenticated access to /internal/v3/ endpoints, including staging callbacks like /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed. While /internal/v4/ and /internal/v5/ are protected, these v3 endpoints remain publicly accessible without OAuth or mutual TLS.

Detection Guidance

Check if /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed endpoints are accessible without authentication. Use curl commands like: curl -v http://<target>/internal/v3/staging/test/droplet_completed and curl -v http://<target>/internal/v3/staging/test/build_completed. If responses are successful without OAuth or mTLS, the vulnerability exists.

Impact Analysis

An attacker with a valid build or droplet GUID can exploit this to forge staging callbacks, transition droplets to STAGED state, and persist arbitrary process metadata or sidecar data without proper authorization. A SpaceAuditor can also enumerate GUIDs to escalate privileges beyond their intended role.

Mitigation Strategies

Upgrade Cloud Controller API (CAPI) to v1.246.0 or later and update cf-deployment to v60.7.0 or greater. Ensure Nginx routing configuration blocks /internal/v3/ endpoints with deny rules. Verify OAuth or mutual TLS is enforced for all internal endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59387. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart