Severity
High
CVSS score: 6.4 (Medium) (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)
Vendor
Cloud Foundry Foundation
Versions Affected
CAPI (Cloud Foundry Controller)
– Confirmed in CAPI up to v1.247.0 (inclusive)
Description
A SpaceSupporter could change the start command and buildpack of an application which is supposed to require a SpaceDeveloper role. This also allows the SpaceSupporter to retrieve service credentials by using a malicious start command or a custom buildpack.
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below.
The Cloud Foundry project recommends upgrading the following releases:
CAPI
– Upgrade CAPI to v1.248.0 or greater
CF Deployment
– Upgrade cf-deployment version to v60.9.0 or greater
– Includes CAPI v1.248.0
Credit
This issue was responsibly reported by Minseong Kim (mak3bread).
History
2026-10-20: Initial vulnerability report published.
