# CVE-2026-59386: Cloud Foundry CAPI privilege escalation to credential exposure

Source: https://junglewise.ai/threats/cve-2026-59386-a-spacesupporter-could-improperly-modify-an-application-s-start  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-59386 · Severity: medium · CVSS 6.5 · Published 2026-10-30

Cloud Foundry's CAPI (Controller API) manages application deployments and configuration in cloud environments. A bug in access controls allows SpaceSupporter users to modify application start commands and buildpacks—actions restricted to SpaceDevelopers—enabling them to steal service credentials such as database passwords and API keys.

Technologies: [Cloud Foundry Foundation Cf-Deployment](https://junglewise.ai/threats/technologies/cloud-foundry-foundation-cf-deployment). Vendors: [Cloud Foundry Foundation](https://junglewise.ai/threats/vendors/cloud-foundry-foundation).

## Quick answers

**Is CVE-2026-59386 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59386 being exploited in the wild.

**How severe is CVE-2026-59386?** Medium severity, with a CVSS score of 6.5, published 30 October 2026.

**Which products and versions are affected?** Cloud Foundry Foundation CAPI up to v1.247.0; Cloud Foundry Foundation Cf-Deployment before v60.9.0.

**Is there a fix for CVE-2026-59386?** Yes: fixed in CAPI v1.248.0 or greater; cf-deployment v60.9.0 or greater. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59386 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-59386?** Check whether you run Cloud Foundry Foundation CAPI or Cloud Foundry Foundation Cf-Deployment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in CAPI v1.248.0 or greater; cf-deployment v60.9.0 or greater

## Technical details

A privilege escalation in Cloud Foundry CAPI up to v1.247.0 permits SpaceSupporter roles to modify application start commands and buildpack settings without proper authorization checks. An attacker with SpaceSupporter privileges can inject malicious start commands or custom buildpacks to execute arbitrary code and exfiltrate service credentials. The vulnerability requires high privilege (SpaceSupporter role) and network access to the CAPI endpoint.

## Affected products

- Cloud Foundry Foundation CAPI up to v1.247.0
- Cloud Foundry Foundation cf-deployment before v60.9.0

## Timeline

- 2026-10-20: disclosed
- 2026-10-30: advisory

## References

- [https://www.cloudfoundry.org/blog/cve-2026-59386-credential-exposure-to-space-supporter/](https://www.cloudfoundry.org/blog/cve-2026-59386-credential-exposure-to-space-supporter/)

## Related threats

- [Cloud Foundry Cloud Controller credential exposure in audit logs](https://junglewise.ai/threats/cve-2026-59388-cloud-controller-capi-leaks-sensitive-data-into-audit-logs-in)
- [Cloud Foundry CAPI broken access control in /internal/v3/ endpoints](https://junglewise.ai/threats/cve-2026-59387-the-nginx-routing-configuration-for-cloud-controller-blocks)