PT-2026-50775 · Cloud Foundry Foundation · Bpm-Release

Published 2026-06-18 · Updated 2026-06-18 · CVE-2026-47833

NVD

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A compromised process inside a bpm container can cause root to chown an arbitrary host file to vcap and append bpm JSON log lines to it. The chown alone lets the attacker take ownership of /etc/shadow and read every password hash on the host via the read-only /etc bind mount. This is a container-to-host confidentiality break affecting every bpm-managed job.

Affected versions: bpm-release, all versions prior to v1.4.30.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-47833

Affected Products

Bpm-Release

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-47833 · Security Note
• https://cloudfoundry.org/blog/cve-2026-47833-symlink-vulnerability-in-setupbpmlogs-allows-container-to-host-privilege-escalation-via-etc-shadow · Note