CVE-2026-59387

The Cloud Foundry Controller (CAPI) , specifically versions up to and including v1.245.0 , contains a broken access control restriction in its Nginx routing configuration. While internal endpoints for /internal/v4/ and /internal/v5/ are protected, the configuration omits a deny rule for /internal...

EUVD-2026-113756

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/dropletcompleted and...