Access Control Vulnerability in Cloud Controller API by Nginx

CVE-2026-59387

What is CVE-2026-59387?

The routing configuration for the Nginx-based Cloud Controller API improperly blocks unauthenticated access to certain endpoints, neglecting to secure the /internal/v3/ endpoint. This oversight allows adversaries with a valid droplet or build GUID to exploit the system by submitting forged staging callbacks, facilitating unauthorized transitions of droplets into a STAGED state and the ability to persist arbitrary process metadata. Furthermore, individuals with auditing permissions, such as SpaceAuditors, can enumerate GUIDs, posing a significant risk of privilege escalation beyond designated role boundaries.

References