CVE-2026-59385: Space Developer can extract space-scoped broker credentials
A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs SpaceDeveloper privileges in the affected space. They must also be able to operate or control a service broker endpoint to which they can redirect the existing space-scoped broker.
What information can be exposed?
Existing credentials configured for a space-scoped broker can be extracted. The impact is limited to confidentiality; the provided severity vector indicates no integrity or availability impact.
How does exploitation bypass normal credential protections?
The CF API does not allow broker credentials to be read directly. A SpaceDeveloper can instead change the broker URL while leaving its credentials unchanged, causing those credentials to be sent to a broker under the attacker's control.