Is CVE-2026-47833 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47833 being exploited in the wild.

How severe is CVE-2026-47833?

Medium severity, with a CVSS score of 6.1, published 18 June 2026.

Which products and versions are affected?

Cloud Foundry Foundation Bpm-Release versions prior to v1.4.30.

Is there a fix for CVE-2026-47833?

A patch was published on 2026-06-18: Fixed in v1.4.30 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47833 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-47833?

Check whether you run Cloud Foundry Foundation Bpm-Release at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47833: Cloud Foundry bpm-release symlink following in setupBpmLogs

CVE-2026-47833 · Severity: medium · CVSS 6.1 · Published 2026-06-18

A vulnerability in the BOSH Process Manager (bpm) allows a compromised container to gain unauthorized access to sensitive files on the host operating system. By manipulating log files, an attacker can take ownership of critical system files like the password database. This allows the attacker to read password hashes for all users on the host, leading to a significant breach of confidentiality and potential full system takeover.

Vendors: Cloud Foundry Foundation.

Quick answers

Is CVE-2026-47833 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47833 being exploited in the wild.
How severe is CVE-2026-47833?: Medium severity, with a CVSS score of 6.1, published 18 June 2026.
Which products and versions are affected?: Cloud Foundry Foundation Bpm-Release versions prior to v1.4.30.
Is there a fix for CVE-2026-47833?: A patch was published on 2026-06-18: Fixed in v1.4.30 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47833 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-47833?: Check whether you run Cloud Foundry Foundation Bpm-Release at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A symlink following vulnerability (CWE-59) exists in the setupBpmLogs component of Cloud Foundry bpm-release. When opening and changing ownership of the bpm.log file, the process (running as root) follows symbolic links created by a compromised process within the container. An attacker can point these symlinks to arbitrary host files, such as /etc/shadow. This causes the root process to change the ownership of the target host file to the 'vcap' user, allowing the attacker to read sensitive data (like password hashes) through the read-only /etc bind mount. The issue is fixed in bpm-release v1.4.30.

Affected products

Cloud Foundry Foundation bpm-release versions prior to v1.4.30

Timeline

2026-06-18: disclosed
2026-06-18: advisory
2026-06-18: patched: Fixed in v1.4.30

References

https://www.cloudfoundry.org/blog/cve-2026-47833-symlink-vulnerability-in-setupbpmlogs-allows-container-to-host-privilege-escalation-via-etc-shadow/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.