CVE-2026-59386

CVSS 6.5 (medium) · published 2026-10-30

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.

Weakness: CWE-269

Source: NVD CVE-2026-59386

References

• https://www.cloudfoundry.org/blog/cve-2026-59386-credential-exposure-to-space-supporter/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.