CVE-2026-47833

setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A compromised process inside a bpm container can cause root to chown an arbitrary host file to vcap and append bpm JSON log lines to it. The chown alone lets the attacker take ownership of /etc/shadow and read every password hash on the host via the read-only /etc bind mount. This is a container-to-host confidentiality break affecting every bpm-managed job. Affected versions: bpm-release, all versions prior to v1.4.30.

• CWE-59

• https://www.cloudfoundry.org/blog/cve-2026-47833-symlink-vulnerability-in-setupbpmlogs-allows-container-to-host-privilege-escalation-via-etc-shadow/

Published

Jun 18, 2026

Last Modified

Jun 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47827Command Injection in BOSH CLI tool on windows in Cloud Found…7.5
• CVE-2026-47828During bosh create-env and bosh delete-env, the CLI uploads …8.8
• CVE-2026-47829Argument Injection in bosh-cli allows a compromised BOSH Dir…7.8
• CVE-2026-4783A vulnerability has been found in itsourcecode College Manag…6.3
• CVE-2026-47830Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-E…8.8
• CVE-2026-47831Use of a cryptographically weak random number generator in t…7.7
• CVE-2026-47834Spring Data JPA's Sort validation can be bypassed when param…6.5
• CVE-2026-47835In Spring AI Vector Stores, special characters could be used…7.5
• CVE-2026-47836The base directory (spring.cloud.config.server.svn.basedir) …8.1
• CVE-2026-47837Missing Authentication for Critical Function vulnerability i…9.8
• CVE-2026-47838SubjectDnX509PrincipalExtractor does not correctly handle ce…8.1
• CVE-2026-47839A vulnerability allows users authenticating through a federa…9.2