What is the CVSS score of CVE-2026-41013?

CVE-2026-41013 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Cloud Foundry diego-release are affected by CVE-2026-41013?

Cloud Foundry deployments using smb-volume-release and CF Deployment are vulnerable to privilege escalation attacks where low-privileged developers can bypass security controls and gain unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-41013?

Within 24 hours: Inventory all Cloud Foundry environments and confirm which systems run smb-volume-release prior to v3.60.0 or CF Deployment prior to v56.0.0. Within 7 days: Apply vendor patches upgrading to smb-volume-release v3.60.0 (or later) and CF Deployment v56.0.0 (or later) in non-production environments and validate functionality. Within 30 days: Deploy patched versions to all production systems and complete remediation.

Cloud Foundry diego-release CVE-2026-41013

EUVD-2026-33727 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-06-01 vmware

GHSA-8h76-qw8h-fmjh

Privilege Escalation Smb Volume Release Cf Deployment

8.1

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 21:24 vuln.today

CVSS changed

Jun 01, 2026 - 21:22 NVD

8.1 (HIGH)

Patch available

Jun 01, 2026 - 20:02 EUVD

CVE Published

Jun 01, 2026 - 17:36 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privileged CF space developer to inject arbitrary kernel CIFS mount options via bypassing the mount-option allowlist, enabling privilege escalation and security control bypass on multi-tenant Diego cells.

Affected versions: smb-volume-release: All versions prior to v3.60.0 CF Deployment: All versions prior to v56.0.0

AnalysisAI

Privilege escalation in Cloud Foundry smb-volume-release (prior to v3.60.0) and CF Deployment (prior to v56.0.0) lets a low-privileged CF space developer smuggle arbitrary CIFS mount options past the mount-option allowlist, gaining kernel-level mount control on shared Diego cells. The flaw maps to CWE-88 (argument injection) and carries CVSS 8.1 with low-privilege network exploitation; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Cloud Foundry's Diego runtime delegates SMB/CIFS volume mounts to a broker that builds kernel mount commands from user-supplied parameters. The smb-volume-release component enforces an allowlist of mount options to keep tenants from passing dangerous kernel CIFS flags (e.g., uid/gid/file_mode, credentials path). Per the Cloud Foundry advisory titled 'Tenant-controlled comma smuggles arbitrary CIFS mount options,' the parser splits and validates options but does not normalize embedded commas, allowing a tenant value to smuggle additional comma-separated options through the allowlist. This is the canonical CWE-88 'Improper Neutralization of Argument Delimiters' pattern, where the boundary between data and argument is not preserved end-to-end across the broker, garden-runc, and the kernel CIFS client on multi-tenant Diego cells (CPE: cloudfoundry_foundation:smb-volume-release and cloudfoundry_foundation:cf_deployment).

RemediationAI

Apply the vendor-released patches: upgrade smb-volume-release to v3.60.0 or later and CF Deployment to v56.0.0 or later, per the Cloud Foundry advisory at https://www.cloudfoundry.org/blog/cve-2026-41013-tenant-controlled-comma-smuggles-arbitrary-cifs-mount-options/. Where immediate upgrade is not possible, operators can disable SMB volume services on affected Diego cells (removing the smb-volume broker from the marketplace) to eliminate the attack surface entirely, at the cost of breaking workloads that legitimately bind SMB shares; alternatively, restrict who can create or bind SMB volume service instances by tightening space-developer assignments and using org/space quotas to limit which spaces can request SMB binds, accepting that this reduces self-service but preserves SMB functionality for trusted spaces. Audit existing SMB service bindings for suspicious mount-option values (especially strings containing embedded commas, uid=, gid=, file_mode=, dir_mode=, or credentials=) before patching to detect prior abuse.