EUVD-2026-37929
GHSA-xhf5-x86m-mrgw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
S:C applied because exploitation crosses the container-to-host boundary, affecting host-level resources (/etc/shadow) outside the vulnerable container's authority.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
Lifecycle Timeline
3DescriptionCVE.org
setupBpmLogs follows symlink for bpm.log open and chown - container-to-host privilege escalation via /etc/shadow. A compromised process inside a bpm container can cause root to chown an arbitrary host file to vcap and append bpm JSON log lines to it. The chown alone lets the attacker take ownership of /etc/shadow and read every password hash on the host via the read-only /etc bind mount. This is a container-to-host confidentiality break affecting every bpm-managed job.
Affected versions: bpm-release, all versions prior to v1.4.30.
AnalysisAI
Symlink-following in Cloud Foundry bpm-release's setupBpmLogs function enables a container-to-host confidentiality breach, allowing a compromised low-privileged process inside a bpm container to manipulate root into chowning an arbitrary host file - including /etc/shadow - to the vcap user. All bpm-release versions prior to v1.4.30 are affected. Once ownership of /etc/shadow is taken, the attacker reads every host password hash via bpm's existing read-only /etc bind mount, effectively breaking the container boundary without requiring any user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and clear exploitation path make this a credible near-term risk.
Technical ContextAI
Cloud Foundry bpm-release (CPE: cpe:2.3:a:cloud_foundry_foundation:bpm-release:*:*:*:*:*:*:*:*) is a BOSH Process Manager that runs Cloud Foundry jobs inside containers with a controlled filesystem namespace. The vulnerable function, setupBpmLogs, opens and chowns bpm.log as root without resolving symlinks first - a classic CWE-59 (Improper Link Resolution Before File Access / Symlink Following) defect. Because the function runs with root privileges on the host and the log path is writable from within the container, an attacker can substitute bpm.log with a symlink pointing to a sensitive host file such as /etc/shadow. The bpm runtime also mounts the host /etc directory into containers as read-only, which the attacker leverages post-chown to directly read the now-attacker-owned /etc/shadow. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N reflects that the attacker must already be operating inside a bpm-managed container with low privileges, but no additional configuration complexity or user interaction is required beyond that foothold.
RemediationAI
The primary fix is to upgrade bpm-release to v1.4.30 or later, which corrects the symlink-following behavior in setupBpmLogs. Operators should update their BOSH deployments referencing bpm-release to pin to v1.4.30+. The Cloud Foundry Foundation advisory at https://www.cloudfoundry.org/blog/cve-2026-47833-symlink-vulnerability-in-setupbpmlogs-allows-container-to-host-privilege-escalation-via-etc-shadow/ should be consulted for official upgrade instructions. If immediate patching is not possible, a compensating control is to audit and restrict write permissions within bpm container log directories so that container processes cannot replace bpm.log with a symlink; note this may interfere with normal log rotation and bpm job startup behavior. Additionally, reviewing which processes run inside bpm containers and enforcing strict workload isolation (e.g., limiting what code executes within bpm-managed jobs) reduces the likelihood that a container compromise can be used to trigger this path. Rotating /etc/shadow credentials on any host where bpm-release versions below v1.4.30 were deployed alongside untrusted or external workloads is advisable as a precaution.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today