Live › vulnerability › CVE-2026-59385
A user with the SpaceDeveloper role can change the URL of a space-scoped service broker without changing its stored credentials. By pointing the broker at a server they control, they can capture the existing broker credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 09:29 UTC. All times on this page are UTC.
Teams running Cloud Foundry with space-scoped service brokers where some users hold the SpaceDeveloper role. The sources do not name affected versions, so the exact range is unknown. Installations without space-scoped brokers, or where only trusted users have SpaceDeveloper, are less exposed.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.
This page as .md · .json · in your agent: get_signal("CVE-2026-59385")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.