Live › vulnerability › CVE-2026-59387
The Nginx routing for Cloud Controller blocks unauthenticated /internal/v4 and /internal/v5 paths but leaves /internal/v3 open, so staging callback endpoints are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can forge a callback that marks a droplet STAGED and stores arbitrary process and sidecar metadata, and a SpaceAuditor can enumerate those GUIDs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 09:29 UTC. All times on this page are UTC.
Cloud Foundry operators running CAPI v1.245.0 or earlier are exposed. The public API listener serves the /internal/v3 staging callbacks without OAuth or mutual TLS, so anyone with a valid build or droplet GUID can forge a staging result, and a SpaceAuditor can list those GUIDs. Hosted CF platforms run by a provider that already patched can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| capi | vendor | <= 1.245.0 | 1.246.0 |
Upgrade CAPI to v1.246.0 or later, or cf-deployment to v60.7.0 or later (ships CAPI v1.247.0).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.
An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.
This page as .md · .json · in your agent: get_signal("CVE-2026-59387")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.