Space Developer can extract space-scoped broker credentials

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.

Etkilenen sürümler2 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• cloudfoundry.org/…er-can-extract-space-scoped-broker-credentials Diğer

Kayıt geçmişi

1. 30 Eki 2026 11:44Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-59387Broken access control restriction in Cloud Controller API
• 6,5 CVE-2026-59386Credential exposure to space supporter
• 4,9 CVE-2026-59396DoS Vulnerability in UAA Related to JWKS URI Handling
• 5,3 CVE-2026-63401Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser
• 8,3 CVE-2026-63338IXP Manager has Broken Object-Level Authorization
• 6,5 CVE-2026-62277LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration