What is the CVSS score of CVE-2026-41013?

CVE-2026-41013 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-41013?

Within 24 hours: Inventory all Cloud Foundry environments and confirm which systems run smb-volume-release prior to v3.60.0 or CF Deployment prior to v56.0.0. Within 7 days: Apply vendor patches upgrading to smb-volume-release v3.60.0 (or later) and CF Deployment v56.0.0 (or later) in non-production environments and validate functionality. Within 30 days: Deploy patched versions to all production systems and complete remediation.

Cloud Foundry diego-release CVE-2026-41013

Q: Which versions of Cloud Foundry diego-release are affected by CVE-2026-41013?

Cloud Foundry deployments using smb-volume-release and CF Deployment are vulnerable to privilege escalation attacks where low-privileged developers can bypass security controls and gain unauthorized…. A patch is available.

EUVD-2026-33727 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-06-01 vmware

GHSA-8h76-qw8h-fmjh

Privilege Escalation Cf Deployment Smb Volume Release Cloudfoundry Foundation

8.1

CVSS 3.1 · Vendor: vmware

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain CF space-developer role
Delivery

Create or bind SMB volume service instance
Exploit

Inject comma-smuggled CIFS options past allowlist
Execution

Diego mounts share with attacker-controlled kernel options
Persist

Escalate privileges on shared Diego cell
Impact

Bypass tenant isolation and access other tenants' data

Vulnerability Assessment

Weakness	CWE CWE-88 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Argument sanitization
Exploitation Conditions	Requires (1) a Cloud Foundry foundation running smb-volume-release < v3.60.0 or CF Deployment < v56.0.0 with the smb-volume service broker registered and enabled in the marketplace, (2) at least one Diego cell configured to accept SMB volume mounts, and (3) attacker possession of CF space-developer privileges in any org/space permitted to create or bind SMB volume service instances. Exploitation is limited where SMB volume services are not deployed, where the smb-volume broker is restricted from tenant spaces, or where the foundation is single-tenant such that kernel mount-option injection does not cross a trust boundary; no end-user interaction is required, but the attacker must already hold a valid CF account with developer-level role on a space that can request SMB binds.
Impact	The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N indicates a network-reachable, low-complexity attack that requires only a CF space-developer role - a role routinely granted to many internal users in shared CF foundations - and yields high confidentiality and integrity impact with no availability impact and unchanged scope. Note that despite S:U, the practical effect described by the vendor (kernel mount-option control on a shared Diego cell) materially affects other tenants on the same cell, so real-world blast radius likely exceeds the 'scope unchanged' label; defenders should weigh that contradiction. EPSS is not provided, the CVE is not in CISA KEV, and no public PoC is referenced, so this is best treated as a credible insider/abuse-of-low-privilege risk in multi-tenant CF deployments rather than mass-exploited; the combination of low privilege requirement, a sole authoritative vendor advisory, and a clear argument-injection primitive still warrants prompt patching in any shared foundation.
Exploit ScenarioDerived	A CF user with the space-developer role in any space on a multi-tenant foundation creates or binds an SMB volume service instance, supplying a mount-option value that embeds an extra comma-separated CIFS flag (for example, smuggling uid=0 or a credentials path) past the allowlist. When Diego mounts the share into a tenant container, the kernel CIFS client honors the smuggled options, giving the attacker effective privilege escalation and the ability to bypass tenant isolation controls on that cell. No public PoC is referenced in the available data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 01, 2026

Privilege escalation in Cloud Foundry smb-volume-release (prior to v3.60.0) and CF Deployment (prior to v56.0.0) lets a low-privileged CF space developer smuggle arbitrary CIFS mount options past the mount-option allowlist, gaining kernel-level mount control on shared Diego cells. The flaw maps to CWE-88 (argument injection) and carries CVSS 8.1 with low-privilege network exploitation; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

RemediationAI

Apply the vendor-released patches: upgrade smb-volume-release to v3.60.0 or later and CF Deployment to v56.0.0 or later, per the Cloud Foundry advisory at https://www.cloudfoundry.org/blog/cve-2026-41013-tenant-controlled-comma-smuggles-arbitrary-cifs-mount-options/. Where immediate upgrade is not possible, operators can disable SMB volume services on affected Diego cells (removing the smb-volume broker from the marketplace) to eliminate the attack surface entirely, at the cost of breaking workloads that legitimately bind SMB shares; alternatively, restrict who can create or bind SMB volume service instances by tightening space-developer assignments and using org/space quotas to limit which spaces can request SMB binds, accepting that this reduces self-service but preserves SMB functionality for trusted spaces. Audit existing SMB service bindings for suspicious mount-option values (especially strings containing embedded commas, uid=, gid=, file_mode=, dir_mode=, or credentials=) before patching to detect prior abuse.

Affected VersionsENISA

smb-volume-release 0 <3.60.0

CF Deployment 0 <56.0.0

Affected Packages

euvd cf_deployment fix: 56.0.0

euvd smb_volume_release fix: 3.60.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Cloud Foundry's Diego runtime delegates SMB/CIFS volume mounts to a broker that builds kernel mount commands from user-supplied parameters. The smb-volume-release component enforces an allowlist of mount options to keep tenants from passing dangerous kernel CIFS flags (e.g., uid/gid/file_mode, credentials path). Per the Cloud Foundry advisory titled 'Tenant-controlled comma smuggles arbitrary CIFS mount options,' the parser splits and validates options but does not normalize embedded commas, allowing a tenant value to smuggle additional comma-separated options through the allowlist. This is the canonical CWE-88 'Improper Neutralization of Argument Delimiters' pattern, where the boundary between data and argument is not preserved end-to-end across the broker, garden-runc, and the kernel CIFS client on multi-tenant Diego cells (CPE: cloudfoundry_foundation:smb-volume-release and cloudfoundry_foundation:cf_deployment).

Know when Cf Deployment gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vmware) PRIMARY 8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Jun 01, 2026 - 21:22 NVD

8.1 (HIGH)

Patch available

Jun 01, 2026 - 20:02 EUVD

CVE Published

Jun 01, 2026 - 17:36 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privileged CF space developer to inject arbitrary kernel CIFS mount options via bypassing the mount-option allowlist, enabling privilege escalation and security control bypass on multi-tenant Diego cells.

Affected versions: smb-volume-release: All versions prior to v3.60.0 CF Deployment: All versions prior to v56.0.0

Executive ViewAI

Why It Matters

Cloud Foundry deployments using smb-volume-release and CF Deployment are vulnerable to privilege escalation attacks where low-privileged developers can bypass security controls and gain unauthorized kernel-level mount access on shared infrastructure. This affects multi-tenant environments and could enable lateral movement, unauthorized data access, or service disruption across Diego cells. Organizations running affected versions require immediate patching to restore security boundaries between tenant workloads.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.0%

Top 90% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.