Broken access control restriction in Cloud Controller API

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.

 

An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.

Etkilenen sürümler2 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• cloudfoundry.org/…ss-control-restriction-in-cloud-controller-api Diğer

Kayıt geçmişi

1. 30 Eki 2026 11:47Yayımlandı

İlgili açıklar

• 2,7 CVE-2026-59385Space Developer can extract space-scoped broker credentials
• 6,5 CVE-2026-59386Credential exposure to space supporter
• 4,9 CVE-2026-59396DoS Vulnerability in UAA Related to JWKS URI Handling
• 5,1 CVE-2026-115828Secret Server device validation error
• 7,3 CVE-2026-11962037954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload
• 8,7 CVE-2025-8574Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion