Medium severity · published Oct 30, 2026
CVE-2026-59386
Credential exposure to space supporter
New
6.5
CVSS
–
EPSS
No
On KEV
Description
A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cloud Foundry Controller (CAPI) · Cloud Foundry
through 1.247.0 · source: vendor
CF
cf-deployment · Cloud Foundry
before v60.9.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59386
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59386
www.cloudfoundry.org
https://www.cloudfoundry.org/blog/cve-2026-59386-credential-exposure-to-space-supporter/
More from cf-deployment
9.0
CVE-2026-41005
UAA accepts SAML Encrypted Assertions authentication bypass
8.8
CVE-2026-59387
Broken access control restriction in Cloud Controller API
8.8
CVE-2020-5417
Cloud Controller may allow developers to claim sensitive routes
8.7
CVE-2026-59335
Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise
7.7
CVE-2020-5420
Gorouter is vulnerable to DoS attack via invalid HTTP responses