CVE-2026-59385
Low
Description
A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.
SeverityLow
CVSS2.7
Exploit probability—
ProductCAPI (Cloud Foundry Controller)
PublishedOct 30, 2026
First seenNov 4, 2026
How to fix
Update
- Cloud Foundry CAPI (Cloud Foundry Controller)v1.248.0 or later
- Cloud Foundry CF Deployment60.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Cloud Foundry CAPI (Cloud Foundry Controller) | v < v1.248.0 | v1.248.0 |
| Cloud Foundry CF Deployment | v < 60.9.0 | 60.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.