{"id":"CVE-2026-59387","kind":"vulnerability","aliases":["CVE-2026-59387"],"related":[],"title":"Cloud Controller: Nginx misroutes /internal/v3 staging callbacks to the public listener","description":"The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.\n\n\n\n \n\n\n\nAn attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.","summary":"The Nginx routing for Cloud Controller blocks unauthenticated /internal/v4 and /internal/v5 paths but leaves /internal/v3 open, so staging callback endpoints are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can forge a callback that marks a droplet STAGED and stores arbitrary process and sidecar metadata, and a SpaceAuditor can enumerate those GUIDs.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"capi","fixed":["1.246.0"],"affected":"<= 1.245.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["capi","cloud-controller","cloud-foundry","nginx","runtime","self-hosted"],"not_affected_if":["capi-1.246.0-or-later","cf-deployment-60.7.0-or-later","default-config-not-used","managed-hosting"],"how_to_check":"- Find your CAPI release version (bosh deployments / cf-deployment manifest); versions up to and including v1.245.0 are affected.\n- Check the Cloud Controller Nginx config for a deny rule on /internal/v3/ (v4 and v5 have one).\n- From outside, request /internal/v3/staging/<guid>/droplet_completed on the public API without credentials; anything other than a denial means exposed.","fix":"Upgrade CAPI to v1.246.0 or later, or cf-deployment to v60.7.0 or later (ships CAPI v1.247.0).","status":"open","published_at":"2026-10-30T09:17:14+00:00","first_seen_at":"2026-10-30T09:29:39+00:00","triaged_at":"2026-10-30T09:30:36+00:00","updated_at":"2026-10-30T09:31:45+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-30T09:30:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Cloud Controller: Nginx misroutes /internal/v3 staging callbacks to the public listener","impact":"medium","summary":"The Nginx routing for Cloud Controller blocks unauthenticated /internal/v4 and /internal/v5 paths but leaves /internal/v3 open, so staging callback endpoints are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can forge a callback that marks a droplet STAGED and stores arbitrary process and sidecar metadata, and a SpaceAuditor can enumerate those GUIDs.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["cloud-foundry","cloud-controller","nginx","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker forges staging callbacks, altering droplet state and injecting metadata","analyst_note":"Confirm affected Cloud Controller versions and the fixed release from the NVD entry or the Cloud Foundry advisory; the sources give no fix.","how_to_check":"- Check the Nginx routing configuration for Cloud Controller and confirm whether a deny rule exists for `/internal/v3/`.\n- Test whether `/internal/v3/staging/` paths answer on the public API listener.\n- unknown for the exact product versions affected, as the sources do not list them.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config-not-used"],"who_is_affected":"Teams that run Cloud Foundry Cloud Controller with its public API listener and Nginx routing in front of it are exposed, since the missing deny rule lets the /internal/v3 staging callbacks through. Deployments that already block /internal/v3 at the proxy or use a different routing layer are likely not affected, though the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00078,"input_tokens":4288,"output_tokens":703,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Cloud Controller versions and the fixed release from the NVD entry or the Cloud Foundry advisory; the sources give no fix.","search":"'-2026':13A,16A '-59387':14A,17A '/internal/v3':5A,45B,117C '/internal/v3/staging':125C,128C '/internal/v4':39B,106C '/internal/v5':41B,108C 'access':104C 'actor':175C 'api':56B,135C 'arbitrari':83B,164C 'associ':172C 'attack':64B,143C 'beyond':190C 'block':37B,102C 'boundari':194C 'build':68B,147C 'callback':7A,49B,75B,123C,156C 'capi':18A,19B 'cloud':1A,21B,24B,35B,100C 'cloud-control':20B 'cloud-foundri':23B 'configur':98C 'control':2A,22B,36B,101C 'cve':12A,15A 'data':169C 'deni':114C 'droplet':70B,79B,149C,159C 'effect':187C 'endpoint':50B,109C,124C 'enumer':92B,179C 'equival':113C 'escal':189C 'forg':73B,154C 'foundri':25B 'guid':71B,94B,150C,180C 'guid/build_completed':129C 'guid/droplet_completed':126C 'host':30B 'intend':192C 'leav':44B 'listen':11A,57B,136C 'make':184C 'mark':77B 'metadata':87B,166C 'misrout':4A 'mutual':61B,140C 'nginx':3A,26B,32B,96C 'oauth':59B,138C 'omit':111C 'open':46B 'packag':173C 'path':42B 'permiss':183C 'persist':163C 'privileg':188C 'process':84B,165C 'public':10A,55B,134C 'reachabl':52B,131C 'result':120C 'role':193C 'rout':33B,97C 'rule':115C 'runtim':27B 'self':29B 'self-host':28B 'sidecar':86B,168C 'spaceauditor':90B,177C 'stage':6A,48B,80B,122C,155C,161C 'store':82B 'submit':152C 'tls':62B,141C 'transit':157C 'unauthent':38B,103C 'valid':67B,146C 'without':58B,137C,181C 'write':182C","nicknames":[],"mitigations":[],"who_affected":"Cloud Foundry operators running CAPI v1.245.0 or earlier are exposed. The public API listener serves the /internal/v3 staging callbacks without OAuth or mutual TLS, so anyone with a valid build or droplet GUID can forge a staging result, and a SpaceAuditor can list those GUIDs. Hosted CF platforms run by a provider that already patched can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-30T09:31:45Z","by":"analyst","doc":"https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/","run_id":1140},"products":{"at":"2026-10-30T09:31:45Z","by":"analyst","doc":"https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/","run_id":1140},"how_to_check":{"at":"2026-10-30T09:31:45Z","by":"analyst","doc":"https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/","run_id":1140},"who_affected":{"at":"2026-10-30T09:31:45Z","by":"analyst","doc":"https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/","run_id":1140}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@vmware.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59387","severity":null,"published_at":"2026-10-30T09:17:14+00:00","modified_at":"2026-10-30T09:17:14+00:00","first_seen_at":"2026-10-30T09:29:39+00:00","fetched_at":"2026-10-30T09:29:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-59387:1140","url":null,"severity":null,"published_at":"2026-10-30T09:31:45+00:00","modified_at":"2026-10-30T09:31:45+00:00","first_seen_at":"2026-10-30T09:31:45+00:00","fetched_at":"2026-10-30T09:31:45+00:00","note":"Read Cloud Foundry advisory (Oct 20): CAPI <= v1.245.0 affected, fix CAPI v1.246.0+ / cf-deployment v60.7.0+. No exploitation or PoC seen; no social search done (B tier)."}],"documents":[{"id":22613,"url":"https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/","title":"CVE-2026-59387 - Cloud Foundry advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}