CVE-2026-59386

MediumCVSS 6.5/10Last modified Oct 30, 2026

Description

A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-269

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 30, 2026
Last modified: Oct 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-593878.8The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an CVE-2026-593886.5Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events CVE-2026-59395.5A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting i CVE-2026-593964.9A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it CVE-2026-59405.5Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program cras CVE-2026-59417.1Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leadi CVE-2026-59425.5Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operation CVE-2026-59437.8Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered do CVE-2026-59448.2An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an A CVE-2026-59467.5Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CH CVE-2026-59475.9Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signe CVE-2026-594998.6: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by