Executive brief
CloudFoundry is an open-source platform used to deploy and manage cloud applications. A security flaw in how the platform handles SMB storage volumes allows low-privileged developers to bypass security restrictions when mounting network drives. This could allow an attacker to gain unauthorized access to the underlying server infrastructure, escalate their privileges, and compromise the security of other customers sharing the same hardware.
Technical details
An argument injection vulnerability (CWE-88) exists in the SMB mount-option validation logic within the CloudFoundry diego-release. By crafting malicious mount options containing commas, a low-privileged space developer can bypass the mount-option allowlist. This allows the injection of arbitrary kernel CIFS mount options such as 'setuids', 'noperm', or 'credentials=/path/on/host'. Successful exploitation enables an attacker to override security protocols, manipulate host-level credentials, and achieve privilege escalation or unauthorized file system access on shared Diego cells. The issue is resolved in smb-volume-release v3.60.0 and CF Deployment v56.0.0.
Affected products
- CloudFoundry Foundation smb-volume-release versions prior to v3.60.0
- CloudFoundry Foundation CF Deployment versions prior to v56.0.0
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory
- 2026-06-01: patched