Quick answers
- Is CVE-2026-59386 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59386 being exploited in the wild.
- How severe is CVE-2026-59386?
- Medium severity, with a CVSS score of 6.5, published 30 October 2026.
- Which products and versions are affected?
- Cloud Foundry Foundation CAPI up to v1.247.0; Cloud Foundry Foundation Cf-Deployment before v60.9.0.
- Is there a fix for CVE-2026-59386?
- Yes: fixed in CAPI v1.248.0 or greater; cf-deployment v60.9.0 or greater. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-59386 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-59386?
- Check whether you run Cloud Foundry Foundation CAPI or Cloud Foundry Foundation Cf-Deployment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: CAPI v1.248.0 or greater; cf-deployment v60.9.0 or greater
Technical details
A privilege escalation in Cloud Foundry CAPI up to v1.247.0 permits SpaceSupporter roles to modify application start commands and buildpack settings without proper authorization checks. An attacker with SpaceSupporter privileges can inject malicious start commands or custom buildpacks to execute arbitrary code and exfiltrate service credentials. The vulnerability requires high privilege (SpaceSupporter role) and network access to the CAPI endpoint.
Affected products
- Cloud Foundry Foundation CAPI up to v1.247.0
- Cloud Foundry Foundation cf-deployment before v60.9.0
Timeline
- 2026-10-20: disclosed
- 2026-10-30: advisory