CVE-2026-59387
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/…
- Risk score
- 63/100
- CVSS
- 8.8 v3.1
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A flaw in Nginx routing configuration for Cloud Controller allows unauthenticated access to certain endpoints, enabling an attacker to submit forged staging callbacks, transition droplets to STAGED, and persist arbitrary process metadata and sidecar data.
- Affected
- {'products': ['Nginx'], 'packages': [], 'versions': ['affected by Cloud Controller routing configuration']}
- Fix
- Check the linked advisory for details on mitigation and potential fixes.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
- On your watchlist: nginx
References
Original description
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.
Last activity 30 Oct 2026. Patch Forecast updates every hour.