Cloud Foundry Controller Capi
Monthly
Privilege escalation in Cloud Foundry's Cloud Controller API (CAPI) lets an account that holds only the SpaceSupporter role perform start-command and buildpack-action modifications that are supposed to require SpaceDeveloper privileges, and then abuse that capability to read the credentials of services bound to applications in the space. Deployments running the Cloud Foundry Controller (CAPI) and CF-Deployment are in scope per the published CPE data, and exploitation requires a valid account already granted SpaceSupporter on a space containing apps with bound services, plus an app staging or restart so the malicious start command or buildpack executes. No public exploit code has been identified at time of analysis and there is no KEV listing; the reported priority is remediation this month, and the separate assessment classifies this as a genuine but contained privilege-escalation issue rather than a top-tier emergency.
Privilege escalation in Cloud Foundry's Cloud Controller API (CAPI) lets an account that holds only the SpaceSupporter role perform start-command and buildpack-action modifications that are supposed to require SpaceDeveloper privileges, and then abuse that capability to read the credentials of services bound to applications in the space. Deployments running the Cloud Foundry Controller (CAPI) and CF-Deployment are in scope per the published CPE data, and exploitation requires a valid account already granted SpaceSupporter on a space containing apps with bound services, plus an app staging or restart so the malicious start command or buildpack executes. No public exploit code has been identified at time of analysis and there is no KEV listing; the reported priority is remediation this month, and the separate assessment classifies this as a genuine but contained privilege-escalation issue rather than a top-tier emergency.