CVE-2026-59386: Credential exposure to space supporter
Published Oct 30, 2026
·Updated
A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.
Event History
Oct 30, 2026
CVE Published
via MITRE·08:35 AM
Data Sourced
via MITRE·08:35 AM
DescriptionSeverity
Data Sourced
via NVD·09:17 AM
DescriptionSeverity
Data Sourced
via NVD·09:17 AM
Weakness
Frequently Asked Questions
1
Does exploitation require existing access to the affected space?
Yes. The attacker needs SpaceSupporter privileges in the space to perform the unauthorized modifications.
2
Which actions can a SpaceSupporter perform through this privilege escalation?
They can improperly modify an application's start command and buildpack, actions that normally require SpaceDeveloper privileges.
3
How could the issue expose service credentials?
An attacker can use a malicious start command or custom buildpack to retrieve service credentials.