PT-2026-50775 · Cloud Foundry Foundation · Bpm-Release

Publicado 2026-06-18 · Atualizado 2026-06-18 · CVE-2026-47833

NVD

CVSS v3.1

6.1

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A compromised process inside a bpm container can cause root to chown an arbitrary host file to vcap and append bpm JSON log lines to it. The chown alone lets the attacker take ownership of /etc/shadow and read every password hash on the host via the read-only /etc bind mount. This is a container-to-host confidentiality break affecting every bpm-managed job.

Affected versions: bpm-release, all versions prior to v1.4.30.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2026-47833

Produtos afetados

Bpm-Release

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-47833 · Nota de Segurança
• https://cloudfoundry.org/blog/cve-2026-47833-symlink-vulnerability-in-setupbpmlogs-allows-container-to-host-privilege-escalation-via-etc-shadow · Nota