---
id: "CVE-2026-59387"
kind: "vulnerability"
aliases: ["CVE-2026-59387"]
title: "Cloud Controller: Nginx misroutes /internal/v3 staging callbacks to the public listener"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "capi", "fixed": ["1.246.0"], "affected": "<= 1.245.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["capi", "cloud-controller", "cloud-foundry", "nginx", "runtime", "self-hosted"]
not_affected_if: ["capi-1.246.0-or-later", "cf-deployment-60.7.0-or-later", "default-config-not-used", "managed-hosting"]
published_at: "2026-10-30T09:17:14+00:00"
first_seen_at: "2026-10-30T09:29:39+00:00"
updated_at: "2026-10-30T09:31:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59387", "first_seen_at": "2026-10-30T09:29:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T09:31:45+00:00"}]
---

# Cloud Controller: Nginx misroutes /internal/v3 staging callbacks to the public listener

The Nginx routing for Cloud Controller blocks unauthenticated /internal/v4 and /internal/v5 paths but leaves /internal/v3 open, so staging callback endpoints are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can forge a callback that marks a droplet STAGED and stores arbitrary process and sidecar metadata, and a SpaceAuditor can enumerate those GUIDs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:capi affected <= 1.245.0 fixed 1.246.0

## How to check

- Find your CAPI release version (bosh deployments / cf-deployment manifest); versions up to and including v1.245.0 are affected.
- Check the Cloud Controller Nginx config for a deny rule on /internal/v3/ (v4 and v5 have one).
- From outside, request /internal/v3/staging/<guid>/droplet_completed on the public API without credentials; anything other than a denial means exposed.

## Fix

Upgrade CAPI to v1.246.0 or later, or cf-deployment to v60.7.0 or later (ships CAPI v1.247.0).

## Timeline

- 2026-10-30T09:29:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59387
- 2026-10-30T09:31:45+00:00 analyst — Read Cloud Foundry advisory (Oct 20): CAPI <= v1.245.0 affected, fix CAPI v1.246.0+ / cf-deployment v60.7.0+. No exploitation or PoC seen; no social search done (B tier).

## Documents

- [advisory] CVE-2026-59387 - Cloud Foundry advisory https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/

## From the sources

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.



 



An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_